ESMA Sanctions Report 2025: What MiFID II Firms and CASPs Must Know About Rising Enforcement

Executive Summary: ESMA's 2025 Sanctions Report

The European Securities and Markets Authority (ESMA) has published its third consolidated sanctions report, covering enforcement actions taken by national competent authorities (NCAs) across the European Economic Area (EEA) in 2025. The headline figures are striking: over 950 administrative sanctions and measures were imposed, with aggregated fines of almost €82 million. While the total number of sanctions remained stable compared to the previous two years, the report reveals persistent and significant divergences in how member states enforce securities law.

Enforcement activity remains highly concentrated. Germany, France, and Spain accounted for two-thirds of the total fine value. ESMA notes that such concentration cannot always be explained by market size alone, raising questions about supervisory consistency. The report also highlights an increased use of settlement procedures across member states and covers breaches primarily under the Market Abuse Regulation (MAR) and the Markets in Financial Instruments Directive and Regulation (MiFID II/MiFIR).

For compliance officers at investment firms, trading venues, and crypto-asset service providers (CASPs), the message is clear: enforcement risk is rising, and ESMA expects greater convergence in outcomes for similar breaches across the EU.

Why Convergence Matters: Implications for MiFID II Firms, Funds, and CASPs

ESMA's call for stronger supervisory convergence is not new, but the 2025 report sharpens the focus. The regulator explicitly states it will continue fostering exchanges among national authorities to ensure that similar breaches lead to similar outcomes across the EU, particularly where limited enforcement activity cannot be explained by market size.

MiFID II/MiFIR Firms

For investment firms and trading venues, the report underscores that compliance with MiFID II obligations—such as transaction reporting, best execution, and conflict-of-interest management—is under heightened scrutiny. The concentration of fines in a few jurisdictions means firms operating cross-border must navigate a patchwork of enforcement intensities. A breach that results in a fine in one member state might go unpunished in another, but ESMA is determined to close that gap.

Investment Funds

Fund managers are also in scope. The report covers breaches under MAR and MiFID II, which include market abuse, transparency, and organizational requirements. With ESMA pushing for convergence, fund managers should expect NCAs to adopt more consistent—and potentially more rigorous—supervisory approaches.

Crypto-Asset Service Providers (CASPs) under MiCA

Contrary to some commentary, MiCA is not a forthcoming regime. The Markets in Crypto-Assets Regulation (MiCA) has been fully applicable since 30 December 2024. CASPs are already subject to authorization and supervisory obligations. The 2025 ESMA sanctions report, while focused on MAR and MiFID II, signals the direction of travel: ESMA is building a culture of consistent enforcement. As NCAs gain experience with MiCA, CASPs should anticipate similar convergence pressures. CASPs must ensure their compliance frameworks meet the same high standards expected of traditional investment firms, particularly regarding market abuse surveillance and governance.

Practical Compliance Implications: What Firms Should Do Now

The ESMA report is more than a statistical overview; it is a supervisory signal. Firms should treat it as a prompt to review their compliance frameworks, particularly in three areas:

1. Sanctions Monitoring and Market Abuse Surveillance: The report covers administrative sanctions for breaches of MAR and MiFID II. Firms must ensure their surveillance systems are calibrated to detect market abuse and other breaches effectively. This is distinct from financial sanctions screening (e.g., OFAC, EU consolidated list), which is governed by AML/CFT rules. However, both areas require robust monitoring and investigation workflows.
2. Disclosure Controls: ESMA has recently updated its guidelines on MAR delayed disclosure. The revised guidelines add five new legitimate interests that may justify delaying disclosure of inside information (e.g., where a public authority requests non-disclosure, or where disclosure risks losing a business opportunity). Firms should review their disclosure policies to align with these updated guidelines, which apply from the date of publication on ESMA's website in all 24 official EU languages.
3. Governance Frameworks: The increased use of settlements and the concentration of enforcement in certain jurisdictions suggest that governance and culture are under the microscope. Boards should ensure they have appropriate oversight of compliance risks and that escalation procedures are robust.

How AI-Driven Surveillance and Case Management Tools Can Help

Managing regulatory change and enforcement risk across multiple jurisdictions is complex. Technology can play a critical role in automating surveillance, streamlining investigations, and ensuring consistent documentation.

AI-driven platforms can enhance market abuse surveillance by analyzing trading data and communications for suspicious patterns. For example, RisksRadarAI is a cross-domain risk intelligence platform that detects compound risk patterns by fusing signals across HR, Finance, Security, Operations, and Communications. While its primary focus includes AML/BSA compliance and fraud detection, its capabilities in behavioral analytics and investigation workflow automation can be adapted to support MiFID II sanctions monitoring. The platform offers automated evidence brief generation and case management, which can help firms respond to regulatory inquiries more efficiently. However, organizations should validate vendor claims—such as false positive reduction rates—against their own data and requirements.

For firms seeking a broader compliance technology stack, AIGovHub provides a vendor marketplace with over 130 compliance vendors across 31 categories, along with interactive tools like the AI Act Risk Classifier and regulatory alerts across 47+ jurisdictions. This can help compliance teams compare solutions and stay informed about evolving supervisory expectations.

Action Checklist for Compliance Officers

Given the ESMA report's findings, compliance officers should take the following steps:

• Conduct a gap assessment: Review your current surveillance and monitoring systems against ESMA's expectations for MAR and MiFID II. Identify any weaknesses in detecting market abuse or other breaches.
• Review disclosure controls: Ensure your policies for delaying disclosure of inside information align with ESMA's revised MAR guidelines, including the five new legitimate interests.
• Enhance board reporting: Provide the board with clear metrics on enforcement trends, including the concentration of fines in certain jurisdictions, and outline steps taken to mitigate cross-border risks.
• Strengthen cross-border coordination: If you operate in multiple member states, develop a consistent approach to compliance that accounts for varying enforcement practices, and consider how ESMA's convergence efforts may affect your risk profile.
• Leverage technology: Evaluate AI-driven surveillance and case management tools to automate monitoring and improve investigation efficiency. Ensure any tool is validated and integrated into your overall compliance framework.

Key Takeaways

• ESMA's 2025 sanctions report reveals over 950 administrative sanctions and €82 million in fines across the EEA.
• Enforcement is concentrated in Germany, France, and Spain, highlighting divergent practices.
• ESMA calls for greater supervisory convergence, signaling rising enforcement risk for MiFID II firms and CASPs.
• MiCA has been fully applicable since 30 December 2024; CASPs are already subject to authorization and supervision.
• Firms should review surveillance, disclosure controls, and governance frameworks to align with ESMA's expectations.
• AI-driven tools can help automate surveillance and investigations, but vendor claims should be validated.

Next Steps: Download Your Sanctions Readiness Checklist

To help compliance teams navigate these developments, AIGovHub offers a Sanctions Readiness Checklist that covers gap assessment, disclosure controls, and board reporting. Download the checklist to benchmark your firm's preparedness.

For ongoing regulatory monitoring and access to compliance tools, explore AIGovHub's regulatory monitoring tools. Stay ahead of enforcement trends and ensure your compliance framework is robust.

This content is for informational purposes only and does not constitute legal advice.