Asset Management | ESMA Published Its Work Programme For 2027 – What Asset Managers Should Focus On To Comply With Supervision

ESMA just published its 2027 Annual Work Programme. The programme shows ESMA moving to closer DORA supervision, new fund reporting systems and direct supervision of ESG rating providers. It keeps cyber and digital operational resilience as a Union-wide Strategic Supervisory Priority. After the first years of DORA, supervisory focus and intrusiveness will increase. Norwegian asset managers are supervised by Finanstilsynet, not by ESMA. However, Finanstilsynet’s priorities will follow ESMA’s closely. In this newsletter we explain what the programme means for Norwegian asset managers.

ESMA just published its 2027 Annual Work Programme. The programme shows ESMA moving to closer DORA supervision, new fund reporting systems and direct supervision of ESG rating providers. It keeps cyber and digital operational resilience as a Union-wide Strategic Supervisory Priority. After the first years of DORA, supervisory focus and intrusiveness will increase. Norwegian asset managers are supervised by Finanstilsynet, not by ESMA. However, Finanstilsynet’s priorities will follow ESMA’s closely. In this newsletter we explain what the programme means for Norwegian asset managers.

Why this matters, and for whom

Authorised AIFMs, UCITS management companies and investment firms are subject to the Norwegian Act on Digital Operational Resilience of 2025, which implements DORA in Norway. For these firms, ESMA’s 2027 priorities are a reliable forecast of the questions Finanstilsynet will ask.

The sustainable finance workstream affects asset managers marketing funds with ESG or sustainability-related features. It also affects firms that buy ESG ratings or ESG data. ESMA supervises ESG rating providers directly from 2027.

DORA: the third year of application, and a harder supervisory edge

ESMA confirms that it will continue to focus on DORA compliance across all of its supervisory mandates and it reiterates to do so in a proportionate manner. ESMA also names the risks arising from the adoption of AI as a common supervisory topic, which is closely linked to the DORA supervisory framework. Three elements deserve attention:

• The register of information: Article 28(3) of DORA requires every financial entity to maintain and update a register of all contractual arrangements for the use of ICT services. The register is kept at entity level and, where relevant, at sub-consolidated and consolidated level. It must be reported to the competent authority annually and upon request. The register is not just a filing exercise. It is a dataset that helps businesses to identify ICT third-party service providers that support critical or important functions. A register that understates a firm’s dependencies misstates its risk profile to its supervisor.
• Incident handling and reporting: Articles 17 to 23 of DORA require a documented process for managing ICT-related incidents. Incidents must be classified against the criteria in the technical standards. Major incidents require initial, intermediate and final reports to the competent authority. The three ESAs (ESMA, EBA and EIOPA) will issue their annual reports on the number, nature and impact of incidents. The reports also cover remedial actions and costs incurred.
• Third-party risk and the DORA review: By the end of 2027 the joint oversight teams of the ESAs will have completed two full years of oversight of critical ICT third-party providers. ESMA states that its work will take account of highly cyber-capable frontier AI models. In 2027, the Commission will invite the ESAs to advise under the review clause in Article 58 of DORA. Topics include the designation criteria for critical ICT third-party service providers, the voluntary nature of notifying significant cyber threats, and the scope of the Regulation.

Investment management: reporting, risk management and value for money

ESMAs agenda on investment management in 2027 turns on three topics: reporting, risk management and value for money.

• Reporting simplification: ESMA aims to move fund reporting to a report-once model. Managers would submit a single integrated report to one national authority. The data would then be validated at EU level and shared with other authorities through a central ESMA hub. For AIFMs, particularly those operating across borders, this should mean fewer duplicate data requests and an end to additional national reporting requirements. In 2027, ESMA moves into implementation. It will develop draft regulatory and implementing technical standards for a single harmonised framework under AIFMD and UCITS, due in the second quarter of 2027, and start a dedicated IT project. The benefits will take time to materialise. Go-live is not expected before the first half of 2029, and the existing templates remain in force until then.
• Risk management under supervisory review: The common supervisory action on the risk management function of AIFMs and UCITS management companies runs with national authorities across 2026 and 2027. ESMA will also look at the use of leverage by funds, liquidity, fund stress testing and the interconnectedness of funds with the rest of the financial system. It will also receive notifications from national authorities when managers activate or deactivate liquidity management tools.
• Value for money and costs: Subject to the finalisation of the Retail Investment Strategy, ESMA will develop technical advice on the revised rules of conduct under the UCITS Directive and AIFMD. The advice will cover the value for money assessment and the requirements preventing undue costs being charged to funds and their investors. Work on the PRIIPs key information document continues in parallel, including the new dashboard section (a new summary section of the key information document giving investors an at-a-glance overview) and the reintroduction of past performance (bringing back historical performance figures, which had been removed from the key information document, as a mandatory disclosure item). ESMA will publish its annual market report on the costs and performance of EU retail investment products in the fourth quarter.

ESG: a simplified rulebook, and closer scrutiny of what funds say

ESMA will guide market participants and national authorities through the transition to the simplified sustainable finance rulebook under the revised SFDR framework. The next steps depend on the legislative outcome. ESMA and the other ESAs may prepare technical advice for new Level 2 measures under the revised SFDR framework. They may also run consumer testing on revised disclosures and distribution, and revise the existing Joint Committee Q&As. Separately, ESMA will review its Guidelines on funds’ names using ESG or sustainability-related terms in light of the SFDR negotiations. This is an item that might force changes to Norwegian fund documentation and marketing material.

ESMA will also support implementation of the Omnibus changes to the CSRD, the European Sustainability Reporting Standards (ESRS) and the EU Taxonomy disclosures. It will publish observed market practices on ESG data in the third quarter and on transition finance in the fourth. It will also complete a stocktake on green bonds in the EU. Greenwashing remains one of the outcomes ESMA measures. One indicator is the share of funds whose ESG name does not match the portfolio behind it.

2027 is also ESMA’s first year of supervising ESG rating providers. Its focus will be on the independence of rating output, the management of conflicts of interest and the soundness of methodologies. Asset managers that rely on purchased ESG ratings should expect methodological changes as providers adjust to supervision.

BAHR comments

BAHR has already covered several of the topics in ESMA’s 2027 programme in detail, including DORA incident handling, ICT third-party risk, the register of information and SFDR 2.0. The programme confirms that these remain areas of focus for Norwegian asset managers. We see four key takeaways:

1. First, ESMA’s language on DORA has hardened, from implementation support to increased focus and intrusiveness. In 2025, supervisors understood that DORA documentation was still being developed. In 2027, they are likely to treat gaps as compliance failures.
2. Second, the register of information is a practical base for designating critical ICT third-party providers. Firms should reconcile it against the ICT contracts actually in force, including intra-group arrangements and sub-contracting chains, before the 2027 reporting cycle.
3. Third, firms remain fully responsible for ICT third-party risk, even where a function is outsourced. Firms should continue to review the contractual framework with their ICT third-party providers against the dedicated DORA requirements. There are AI tools that can assist this task in practice.
4. Fourth, the ESG workstream is a rewriting exercise, not a reporting one. A revised SFDR, revised Guidelines on funds’ names and supervised ESG rating providers will change what a fund may be called, what it must disclose and what data it may rely on.

The 2027 Annual Work Programme (ESMA22-50751485-1673) is available here.

Here is a summary of planned ESMA deliverables for 2027 that are most relevant for asset managers.

Our previous newsletters cover these topics in more detail: