The Autorité des Marchés Financiers publishes the findings of its inspections of asset management companies' operational risk management

Operational risk constitutes a significant concern for asset management companies, regardless of their size or structure. It encompasses risks related to internal processes, information systems, human resources, external service providers and cyber events. Implementing a robust operational risk management framework is therefore essential, as it protects investors, ensures compliance with professional obligations and minimizes the potential for losses arising from process deficiencies, human errors, or system failures.

In its quarterly report on trends, risks and vulnerabilities, published in November 2025, ESMA (the European Securities and Markets Authority) ranks operational risk among its priority concerns, at the same level as market risk, in line with its findings established in 2024.

The AMF conducted a series of SPOT (Operational and Thematic Supervision of Practices) inspections at five asset management companies with varying sizes and organisational structures. The inspections covered the period from 1 January 2022 to 31 December 2024.

For the five asset management companies, the AMF looked at the following points: 

1. the organisation and resources dedicated to operational risk management;
2. the procedures for identifying and monitoring operational risks and dealing with incidents;
3. the methods for collecting, investigating and monitoring these operational incidents;
4. professional liability risk coverage;
5. the systems for reporting operational risks and incidents to senior management and to the AMF;
6. internal control works.

The asset management companies on the panel have a dedicated operational risk management function, generally reporting to the Chief Compliance and Internal Control Officer, or to the Risk Manager, with direct access to senior management. The associated governance framework ensures that these risks, and related incidents, are continuously monitored by specialised committees.

The procedures generally provide a clear description of the processes for assessing risks and investigating operational incidents, as well as their link with complaints handling. However, they offer less details on how the losses associated with these incidents are recorded in the accounts, or subsequently verified.

The asset management companies have set up a computerised register to record operational incidents. An analysis of these records shows that the severity level of the events (that actually occurred or were avoided) is not systematically assessed. In addition, the progress of remediation plans is only partially monitored.

Most of the asset management companies on the panel have double cover against operational risks, combining an additional own funds margin with subscription of a professional indemnity insurance. However, despite the AMF's recommendations, the calculation methods used when creating this cushion remain insufficiently formalised.

The asset management companies on the panel have also established a system for reporting operational incidents to senior managers. However, the materiality thresholds that determine which incidents are excluded from these reports are not always clearly defined. In addition, the inspection revealed significant inaccuracies in the operating loss amounts reported to the regulator by one of the companies on the panel in its annual disclosure sheets (FRAs). In this context, the AMF reiterates that the quality and reliability of the data reported by supervised entities are critical to the effectiveness of its supervisory role.

Finally, the AMF noted that the internal control systems analysed adequately cover the operational risk management process. The works carried out led one asset management company to launch a process improvement plan for the department responsible for monitoring market operations, in response to recurring operational incidents.

Among the good practices, the AMF identified the following:

• defining in advance, and in quantitative terms, the maximum level of operational risk that the asset management company considers it can bear in the course of its activities, taking into account the costs of post-incident remediation;
• putting in place structured, dated and validated incident investigation forms;
• ensuring regular reconciliation of operational losses recorded into the accounts with the incident register.

Conversely, the AMF identified as poor practices:

• not including, in the operational risk map, a table for the gradual assessment of the financial and non-financial impact of these risks;
• having multiple non-harmonised incident registers;
• not considering, during the selection phase of major or sensitive external service providers or delegates, the operational risks associated with the services intended to be outsourced.

About the AMF
The AMF is an independent public authority responsible for ensuring that savings invested in financial products are protected and that investors are provided with adequate information. The AMF also supervises the orderly operations of markets. Visit our website: https://www.amf-france.org/en