National authorities across the EEA imposed more than 950 administrative sanctions and measures in 2025, with aggregated fines of almost €82 million — and ESMA says the spread across jurisdictions is still too wide. The EU regulator published its third consolidated sanctions report on 15 October 2026, covering enforcement under EU financial acts within its remit.

The headline count is stable. It matches the past two years, ESMA reported. The report also records increased use of settlements, an outcome that matters for compliance desks pricing the cost of resolving a probe versus litigating it.

Where did the enforcement land?

As in prior years, activity concentrated on breaches of the Market Abuse Regulation (MAR) and MiFID II/MiFIR. That is not a surprise. Those regimes carry the broadest reporting, surveillance and conduct obligations for trading firms.

Geography skews the numbers hard. Germany, France and Spain accounted for two thirds of the total value of administrative fines across the EEA. Enforcement activity, ESMA notes, "remained concentrated in a small number of jurisdictions."

For a firm operating across multiple EU venues, that concentration has a practical read: the same conduct can carry materially different enforcement exposure depending on which national competent authority holds the file.

What does ESMA want to change?

The report flags "significant differences in enforcement" across member states — in the number and type of sanctions, fine levels, and the use of settlement procedures. ESMA's core finding: convergence is needed, "particularly where limited enforcement activity cannot be explained by market size."

That last clause is the sharp edge. A small market should produce few sanctions. A large market with near-zero output is harder to explain, and ESMA is implicitly putting those jurisdictions on record.

The regulator also draws a boundary around what the data can prove. Supervisory effectiveness "should not be measured solely by the number or value of the sanctions imposed in a Member State," the report states, while adding that enforcement actions remain "an important component of the supervisory toolkit."

So: mandated versus asserted. Nothing in this report changes any rule, fine ceiling or deadline. It is a transparency exercise plus a political signal, published alongside the full dataset in Excel so desks and law firms can run their own cuts.

What happens next?

ESMA says it will continue fostering exchanges among national securities authorities on consistent implementation of capital markets rules, including through case discussions. The stated objective: "similar breaches result in similar enforcement outcomes across the EU, irrespective of where they have been committed."

Three documents accompany the release, all dated 15 October 2026:

• The full report (ESMA43-502934634-2902)
• The consolidated sanctions table in Excel format (ESMA43-502934634-2993)
• A one-page enforcement snapshot (ESMA43-502934634-2953)

For compliance and surveillance teams, the Excel table is the working artifact — jurisdiction, regime, sanction type and value for every reported action in 2025. Expect the convergence push to resurface in ESMA's supervisory convergence work programme, with case-level coordination among national authorities as the mechanism to watch.

By Daniel Okafor