ESMA publishes Final Report on 2023 CSA and Mystery Shopping exercise focusing on marketing

RegCORE – Client Alert | Capital Markets Union

QuickTake

Financial services firms’ level of compliance with marketing standards have long been the subject of supervisory scrutiny of national and EU regulatory policymakers. At the end of May 2024, the European Securities and Markets Authority (ESMA) published its Final Report on the application of MiFID II disclosure requirements with regard to marketing communications including advertisements.ESMA’s Final Report is available here.Show Footnote The Final Report, which assesses market practices and compliance standards of credit institutions and investment firms presents the main findings and observations from ESMA, together with those of national competent authorities (NCAs). The Final Report follows on from the use of ESMA’s and NCAs’ applications of relatively new supervisory tools in: (a) Common Supervisory Actions (CSAs) and (b) Mystery Shopping exercises (MSEs).

The Final Report is explicitly clear in setting out what ESMA considers to be both good and (a larger share of) bad practices by investment firms as well as the resulting supervisory expectations it directs to NCAs (in discharge of their own supervisory mandates) as well as to the market as a whole. In a compact 37 pages of text, there are certainly a number of lessons that can be learned by financial market participants active in areas beyond ESMA’s mandate as well as in respect of activity outside of the EU. ESMA is also unequivocally clear in its Final Report that it will continue liaising with NCAs on the topic, including in respect of follow-up actions as well as assess whether there is a need “…to use supervisory convergence tools to build a stronger supervisory culture across the EU and promote effective, sound and consistent supervisions with regard to marketing communications including advertisements.” ESMA also leaves the door open by stating that it “…will stand ready to prepare Level 2 measures stemming out of the Retail Investment Strategy once it is finalised” – see sperate coverage from our EU RegCORE on that development.

This Client Alert provides (i) an assessment of the key takeaways from the Final Report and (ii) concludes with an outlook for existing or new market entrants into the EU’s Single Market for financial services and what this means for compliance with marketing and financial promotions rules, in particular where these may become more harmonised in detail and how these are supervised. This Client Alert should be read in conjunction with further coverage from our EU RegCORE Thought Leadership siteMaterials as made available from time to time on the following site.Show Footnote on use of CSAs and MSEs as used by NCAs, ESMA and other European Supervisory Authorities (ESAs)

Key takeaways from the Final Report

The Final Report explains that the topic of marketing communications, including advertisements, was selected for the 2023 CSA and MSE based on the fact that ESMA:

1. identified “aggressive marketing practices as an investor protection related risk” in its Multi-annual Strategy Document 2023-2028 (see separate coverage from our EU RegCORE on that development). In ESMA’s view “…this risk is characterised by the risk of inappropriate products being purchased by new, young and/or first-time investors, who do not understand the risk of products they are investing in. There is likely an inadequate assessment of whether the client has the necessary experience and knowledge in order to understand the risks involved in relation to the product or service offered or demanded. This can subsequently lead to the risk of unclear, unfair and misleading communications by investment firms to retail investors to nudge them to make decisions on a do-it-yourself basis. The CSA and MSE exercises do not assess the materialisation of these risk, but assess compliance of marketing communications with the applicable MiFID II requirements.”;Importantly, as explored in other analysis from our EU RegCORE this is not the first time ESMA has decided to explore “nudging”.Show Footnote and 
2. due to the key role that marketing communications can play in determining consumer behaviour and influencing investment decisions. Specifically ESMA is concerned with “…the phenomenon of ‘anchoring bias’ that makes people be over reliant on the first piece of information they receive. Retail investors who are subject to misleading marketing communications are more likely to be mis-sold an unsuitable/inappropriate financial product and service, even where correct information is provided through regulatory disclosures (such as PRIIPs KIDs). For many retail investors, decisions about if and how to invest are significantly influenced by information conveyed in marketing communications. Younger, less experienced investors, operating online are particularly vulnerable. Such investors are especially targeted by marketing on social media through for example influencers but also through other types of (private) messages on social networks.”

The Final Report reminds market participants that the MiFID II framework includes detailed (and in ESMA’s view, well established) provisions related to marketing communications, such as the requirement that they should be clearly identifiable as such and consistent with any information the firm provides to clients in the course of carrying on investment and ancillary services. Nudging and anchoring bias may not be new, but ESMA’s (and equally NCAs) interest in the topic, including using CSA and MSEs to test compliance standards and approaches is of course comparably a more stringent approach to this area.

The Final Report describes the background and organisation of the CSA and MSEs. In summary both of these supervisory tools were applied in a targeted market-wide engagement, which involved 27 NCAs for the CSA and seven NCAs for the MSE. This translated into sample set of a total of 208 firms for the CSA and 62 firms that were in scope of the MSE, mostly comprising credit institutions and investment firms.

The Final Report also recaps the methodology and assessment framework for both exercises, which focused on (a) the internal policies, processes and procedures adopted by firms to ensure compliance with MiFID II requirements applicable to marketing communications, including advertisements and (b) on the review of examples of marketing communications, including advertisements and their compliance with MiFID II requirements.

The Final Report sets out the main findings and observations from both exercises, which are divided into two sections: one on the organisation and procedures related to marketing; and one on the content of marketing communications, including advertisements, to clients and potential clients. The Final Report highlights the positive practices and the areas of improvement or non-compliance identified by NCAs in both sections and provides ESMA’s views and recommendations on the main issues observed.

ESMA’s main findings and observations from the section on the organisation and procedures related to marketing can be summarised as follows: 

• Generally, most firms had procedures in place regarding the production, approval and review of marketing communications, including advertisements, which involve both a business function and a control function and which are regularly reviewed and updated.
• Many firms have processes and procedures in place to determine the target audience for their products and services and to adjust their marketing strategy and channels accordingly. However, ESMA also noted that the approaches adopted by firms may differ (for some firms quite widely) depending on the type of financial instrument or the distribution channel through which product advertisements or generic brand related (not product specific) marketing communications are published.
• Firms use different types of distribution channels and types of marketing communications, including advertisements, such as websites, social media, newsletters, webinars, podcasts, videos, etc. and have record-keeping processes in place for them. Most firms had some form of record-keeping process in place for marketing communications, including advertisements, especially for social media posts. However, some firms did not have written procedures stipulating the storage of marketing data or were not able to provide evidence of the approval of specific marketing communications.
• Most firms performed regular reviews of the arrangements and procedures in place related to marketing communications, including advertisements, by the compliance function and the internal audit function and communicated and addressed any deficiencies to the marketing department and senior management.
• Firms use third parties for activities related to marketing communications, including advertisements, such as (f)influencers (see separate coverage from our EU RegCORE on rules applicable to finfluencers), affiliates, or external service providers and have criteria and agreements in place to select and review them. A large number of firms using third parties for activities related to marketing communications, including advertisements had generally reviewed and approved the communications produced by third parties before publication. However, some firms did not have adequate review and approval processes for the use of third parties, especially for more innovative types of tools such as social media or (f)influencers.
• Firms have processes and controls in place to ensure the consistency of information used for marketing purposes with (regulatory) product information and to provide links and/or references to both underlying legal and regulatory documents.
• Most firms performed a review of marketing communications, including advertisements, to verify that they were distributed as approved and to take remedial actions if deficiencies were detected.
• Firms have processes and controls in place to handle complaints related to marketing communications, including advertisements and to provide easy ways for clients to ask for explanations and clarifications.
• Two NCAs pre-approve marketing communications, including advertisements, related to certain products, such as those subject to the prospectus obligations, UCITS, AIFs and PRIIPs.
• Most firms did not have specific processes and procedures in place for sustainability-related claims in marketing communications, including advertisements and applied the same process adopted for all other products. However, some firms adopted additional controls or guidance specific to marketing campaigns concerning products with sustainability features, with particular attention to the risk of greenwashing.

Specifically, ESMA calls out that “With regard to the definition of ‘marketing communications including advertisements’, responses highlighted that, overall, firms have an internal list with descriptions of what constitutes ‘marketing and advertisement’ content but there is little conformity or convergence across firms with respect to it.” Furthermore, ESMA states that “It was noted that a definition would be beneficial in this regard, to ensure that all firms are adopting similar practices and approaches to the different mediums they use to communicate with their target audiences.” 
The Final Report goes on to further summarise the main findings and observations from the sections on the content of marketing communications, including advertisements, to clients and potential clients as follows:

• Marketing communications, including advertisements, are generally clearly identifiable as such and comply with the MiFID II requirements, although some firms shy away from marketing specific products and focus more on general services, brand awareness or educational material. Specific bad practices include:
  • Marketing communications that are not clearly identifiable as such, or that blur the line between factual information and subjective opinion; and
  • Marketing communications that do not present the risks and benefits of the products or services in a balanced manner, or that hide or obscure the risk information in footnotes, different layers, or small fonts.
• Information in marketing communications, including advertisements, is generally presented in a fair, clear and not misleading manner, which includes looking at whether information is balanced, meaning that risks and benefits are equally prominent and whether information on costs, charges and special offers is clear and accurate. Specific bad practices include: 
  • Marketing communications that do not provide clear and accurate information on costs and charges, or that use misleading claims such as “zero costs” without specifying the exceptions or conditions; and 
  • Marketing communications that use comparisons, past or future performance, or simulations without complying with the relevant MiFID II requirements or providing the necessary warnings or disclaimers.
• Some wider-reaching issues or areas of improvement were observed by ESMA across the Final Report, such as: 
  • Some firms did not have processes and controls in place at all. Other firms did not appoint a responsible contact within the organisation. Firms did not specify what kind of measures were taken if the information is not up to date. Some firms applied quite passive monitoring of advertisements by firms, for example they only do so after receiving complaints on the advertisements; 
  • Certain product distributors did not always consider themselves as responsible for the marketing communications made by manufacturers. As a consequence, the distributors did not carry out any due diligence to verify the contents of the marketing communications drafted by manufacturers which the distributors were transmitting;
  • Risks and benefits are not presented in a balanced manner, or in some cases, risk information is completely missing, especially in short messages, such as banners or social media posts, or in videos, where risks are shown in a different font size or colour, or at the end of the text or video, or for a very short period of time, or in a different layer of information; 
  • Risk warnings, such as those related to Contracts for Differences (CFDs), past and future performance, or sustainability, are not always displayed in a prominent manner, or are omitted, or are hidden under a drop-down heading, or are shown in small prints or footnotes.
  • Information on costs and fees is presented in an unclear and sometimes misleading manner, such as mentioning zero costs claims without indicating that other fees apply, or omitting additional costs or fees, or not indicating how fees affect the simulated result; 
  • Information on comparisons and references to past and future performance is not always presented in a fair and balanced manner or does not comply with the conditions set out in the MiFID II Delegated Regulation or is not substantiated by sources or data;
  • Information lacks balance and neutrality or sometimes includes misleading statements, such as giving ratings or scores to firms or products without explaining their meaning or source or suggesting better performance or lower volatility for sustainable investments without enough substantiation or implying that an investor can become an experienced investor through the education material provided by the firm. Some firms also used data that was more than 10 years old; 
  • The language and tone of voice used by some firms in the marketing communications, including advertisements, is not always simple and clear, or requires some financial literacy, or varies depending on the type of information presented; 
  • Some firms promote themselves as “sustainable” or mention their adherence to voluntary ESG or net zero alliances or to reporting initiatives, without corroborating their sustainability claims or providing enough information to allow clients to understand their meaning and implications; and 
  • Some firms make sustainability claims regarding products, such as referring to disclosures required under Article 8 or Article 9 of SFDR, or to ESG ratings or labels, without providing enough information to allow clients to understand their meaning and implications, or without ensuring the consistency of information with the underlying legal and regulatory documents, or without presenting the sustainability features of financial instruments or services in a balanced manner compared with the other features of the products.
• Good practices identified by ESMA included:
  • Marketing communications that use checklists, trainings and workshops to ensure the clarity and fairness of the information provided;
  • Marketing communications that display the risk warnings in a prominent and visible way, using different colours, fonts, or boxes to attract the attention of the readers; 
  • Marketing communications that provide easy and direct access to the regulatory and product information, such as KIDs, prospectuses, or reports, using hyperlinks or references;
  • Marketing communications that use social media and digital platforms in a responsible and transparent way, avoiding aggressive or intrusive practices and providing contact details and channels for clients to ask for explanations or clarifications;
  • Marketing communications that include sustainability-related claims or references that are consistent and coherent with the sustainability features of the products or services, or with the firms’ own commitments, strategies and progress in this area and that provide supporting documentation or information;
  • Daily checks of social media by firms;
  • Periodic reviews and ‘ad-hoc’ checks of the website and online content, whilst maintaining an audit trail for both live and archived versions of marketing and advertising content. 
  • A weekly horizon scanning of the contents (including as produced by parties in a distribution chain and/or by outsourcing providers) undertaken by the compliance function.

Key considerations for financial services firms

The Final Report provides a valuable insight and analysis of the current state of play and the challenges and opportunities of marketing communications under MiFID II and sets the direction and agenda for future actions and developments in this field. There are also a number of lessons learned that may apply in the EU beyond the MiFID II framework as well as comparable considerations that travel well outside the EU. Accordingly, in addition to avoiding or remedying bad and embracing good practices highlighted above, financial services firms may wish to consider: 

• Training and educating their staff on the relevant (MiFID II and other) requirements and expectations on marketing communications and provide them with the necessary tools and guidance to ensure compliance and quality; 
• Reviewing and updating their: 
  • internal policies and procedures on marketing communications and ensuring that they are effectively implemented and monitored by the relevant functions and senior management;
  • existing and planned marketing communications and ensure that they are fair, clear and not misleading and that they provide balanced, accurate and consistent information to clients and potential clients; 
  • outsourcing arrangements and agreements with third parties involved in marketing activities and ensuring that they have adequate oversight and control over the quality and compliance of the marketing communications produced or distributed by these third parties;
  • record-keeping systems and processes for marketing communications and ensuring that they can store and retrieve all the relevant information and documents, including the approval and review processes, for each marketing communication;
  • complaint-handling systems and processes for marketing communications and ensure that they can receive, record and address any complaints or feedback from clients or potential clients regarding the information provided or the practices used in marketing communications;
  • sustainability-related claims and references in marketing communications and ensure that they are substantiated by evidence, data, or sources and that they are aligned with the sustainability features of the products or services or with the firms’ own commitments, strategies and progress in this area;
• Using social media and digital platforms in a (more) responsible and transparent way and ensuring that they comply with the same standards and rules as other means of communication and that they provide adequate information and contact details to clients and potential clients; 
• Cooperating and communicating with the NCAs and ESMA on the follow-up actions and outcomes of the CSA and MSE and implementing the required or requested remedial actions or specific measures in a timely and effective manner; and
• Forward planning the consultation and engagement process on the Retail Investment Strategy and the related Level 2 measures and preparing for the possible changes or impacts that these measures may have on their marketing communications and practices.

Outlook and next steps

The Final Report concludes, especially in light of ESMA identifying more bad than good practices, by stating that follow-up actions are planned or will be taken by NCAs and ESMA based on the findings of both exercises. Specifically, the Final Report states that NCAs have communicated the results of the exercises to the selected firms, providing feedback and recommendations for improvements or requests for remedial actions or specific measures in case of deficiencies detected or breaches.

The Final Report also states that NCAs will undertake follow-up actions on individual cases, where needed, to ensure that regulatory breaches as well as shortcomings or weaknesses identified are remedied. Moreover, the Final Report states that some NCAs have reported other follow-up actions, such as publishing a communication or organising workshops or seminars to share the findings, good and bad practices, trends and supervisory expectations with the market, or updating the national Q&A or guidelines on marketing communication requirements or carrying out a desktop-based thematic review of marketing communications, including advertisements, by surveying all market participants.

Finally, ESMA explains that it will continue liaising with NCAs on compliance on rules applicable to marketing and advertisements exchange on their (planned) follow-up actions. Moreover, ESMA will assess whether there is a need to use supervisory convergence tools to build a stronger supervisory culture across the EU and promote effective, sound and consistent supervision with regard to marketing communications, including advertisements. The Final Report also confirms that ESMA stands ready to provide technical advice to the European Commission to support the development of any delegated acts stemming from the Retail Investment Strategy (see separate coverage from our EU RegCORE) once it is finalised. In summary, financial services firms (including those spared by the current CSA and/or MSE) and assess their level of compliance with rules and supervisory expectations so as to stay ahead of the curve in light of more intrusive supervisory scrutiny. 

About us

PwC Legal is assisting a number of financial services firms and market participants in forward planning for changes stemming from relevant related developments as well as conducting targeted compliance reviews. We have assembled a multi-disciplinary and multijurisdictional team of sector experts to support clients navigate challenges and seize opportunities as well as to proactively engage with their market stakeholders and regulators.

Moreover, we have developed a number of RegTech and SupTech tools for supervised firms, including PwC Legal’s Rule Scanner tool, backed by a trusted set of managed solutions from PwC Legal Business Solutions, allowing for horizon scanning and risk mapping of all legislative and regulatory developments as well as sanctions and fines from more than 1,500 legislative and regulatory policymakers and other industry voices in over 170 jurisdictions impacting financial services firms and their business.

Equally, in leveraging our Rule Scanner technology, we offer a further solution for clients to digitise financial services firms’ relevant internal policies and procedures, create a comprehensive documentation inventory with an established documentation hierarchy and embedded glossary that has version control over a defined backward plus forward looking timeline to be able to ensure changes in one policy are carried through over to other policy and procedure documents, critical path dependencies are mapped and legislative and regulatory developments are flagged where these may require actions to be taken in such policies and procedures.

The PwC Legal Team behind Rule Scanner are proud recipients of ALM Law.com’s coveted “2024 Disruptive Technology of the Year Award”. 

If you would like to discuss any of the developments mentioned above, or how they may affect your business more generally, please contact any of our key contacts or PwC Legal’s RegCORE Team via de_regcore@pwc.com or our website.