When the European Securities and Markets Authority (ESMA) issues a Common Supervisory Action (CSA), enforcement tends to follow. That has been the pattern. CSAs are designed to generate supervisory intelligence, identify systemic gaps, and create the basis for coordinated regulatory response across national competent authorities in the EU.
In my view, and based on what we observed across the market, enforcement actions will follow this one.
Surveill reviewed 154 Cyprus Securities and Exchange Commission (CySEC) regulated forex and CFDs firms across 45 conflict-of-interest controls aligned to the CSA 2026 priorities. The conclusion is consistent. The issue is not whether firms have conflict frameworks. It is whether those frameworks reflect how the business actually operates today. What we found indicates they do not.
A Decade Without an Update
One finding stands out above all others.
We identified a major CySEC -regulated firm whose conflicts of interest policy had not been meaningfully updated in ten years. Not revised. Not reviewed. The document existed, but the substance remained unchanged.
This is not a gap. It is a governance failure.
And that firm is not an isolated case. It is the extreme point on a curve that describes most of the market.
Read more: Cyprus Built Its Name on CFDs. Now a Crypto Exchange Is One of Its Biggest Hirers
Across the firms we reviewed, policies reflect a version of the business that no longer exists. The conflicts described are those that were relevant when the framework was first written. The governance mechanisms are built around those same categories. Version numbers may have changed. Years on the document may have been updated. The substance did not move.
What is missing are the areas that now define the business. Affiliate ecosystems. Finfluencer-driven acquisition.
Digital platforms where clients make decisions. The policy was written once. The business moved on. The policy did not.
What the Data Shows
Across inducements and distribution, firms score between 1 and 1.5 out of 3 - the higher the score, the better. Traditional conflicts are addressed: staff remuneration, third-party payments , and commissions.
Coverage drops sharply where conflicts arise through affiliate models, introducing brokers, and influencer-driven channels. These are now core to how clients are acquired. They are largely absent from policy frameworks.
Digital platforms show the weakest performance of all. The average score is 0.33 out of 3, the lowest category across all 45 controls assessed. In 90% of cases, policies do not acknowledge that platform design choices can create conflicts between a firm's commercial interests and client outcomes. Product ranking, default settings, push notifications, and interface design do not appear in the language.
These are not new risks. They are absent because the policies have not been updated to reflect them.
- 10x Down to 2x: Has Europe Killed Crypto Perps Even before It Started?
- ESMA Seeks Feedback on Draft EMIR 3 Standards for Post-Trade Risk Reduction
- ESMA Is Curious About Retail Investors' Habits: What's Coming?
The Governance Layer That Was Supposed to Catch This
Governance structures appear strong on paper. Registers exist. Escalation processes are documented. Reporting lines are clear.
Governance defines what is seen. If governance has not required the firm to revisit its conflict framework as the business evolved, as affiliate models scaled, as platforms became the primary client environment, as finfluencers became a material acquisition channel, then the framework will not capture the risks that now exist. It will only govern the risks it was originally built to see.
The low scores on inducements and digital platforms are not just framework gaps. They are evidence that the governance layer above them did not perform its function.
Conflicts of interest have become an afterthought. Something to be maintained on paper rather than managed in practice.
When a policy is not updated for ten years, governance does not fail quietly. It failed completely.
Why Enforcement Will Follow
CySEC has committed to on-site visits and desk-based reviews. Inspectors will test whether what is written in policy reflects how firms operate. That is a materially different standard from a document submission.
Where platform conflicts are not captured in writing, the gap will be visible from the first question. Where distribution models and affiliate relationships are not reflected in the framework, the exposure is immediate. Where policies have not evolved in substance for years, credibility is compromised before the conversation begins.
This is not a CySEC-specific issue. ESMA is coordinating this CSA among the EU's national competent authorities. What we observed in Cyprus is likely indicative of a broader market pattern. The supervisory pressure is not local. It is structural and it is continent-wide.
