Research · kidcheck.eu · v4

The State of PRIIPs KID Compliance, 2026

Four studies: a cross-segment audit of 112 Key Information Documents from ~30 manufacturers, a population-scale scan of 2,549 documents sampled from eight major structured-products issuers' own public KID endpoints (drawn from the full ESMA FIRDS register of 8.96 million live retail products) and 90 insurance-product KIDs from 24 German and Polish life insurers, the segment where supervisors historically found the worst defect rates, and a cross-language study of products published in more than one language. Every counted defect verified by hand. The result upends the usual story: the document factories work. It's the estates that fail.

Published 30 July 2026 · updated 31 July with the population scan · updated 28 August with the insurer study · updated 22 September with the cross-language study · affected manufacturers notified before publication · hello@kidcheck.eu

"Clean" means every automated check passed, including cost-table arithmetic. Findings a machine flagged but a human could not confirm in the document text were discarded, not counted.

Why we ran this study

Every supervisory review of published KIDs found defects to be the norm: BaFin's 2022 review objected to 34 of 36 documents; Belgium's FSMA found the majority of 100+ examined KIDs inadequate; ESMA's own text-mining of 54,384 KIDs found almost none fully complete; the ESAs measured internally inconsistent cost tables in a quarter of fund KIDs. But every one of those datasets predates the revised technical standards in force since January 2023. Nobody had measured what is actually being served to retail investors today, so we did.

Study 1: 112 documents across every product type

Funds, ETFs, structured products and insurance-based products from ~30 manufacturers in six languages, collected from the manufacturers' own websites: 79% fully clean, 12% warnings, 9% hard template defects. The defects: four-page KIDs in one issuer's certificate line (the law allows three), the prescribed "required by law" statement rewritten across a US bank's programme in two languages, a five-page closed-end fund KID, renamed mandatory headings at a French boutique. Most commonly, staleness: one document in ten carried no date newer than twelve months, the oldest 32 months back. Of 69 documents whose cost tables could be machine-read, zero failed to reconcile, where the ESAs' pre-2023 data found ~25% of fund KIDs inconsistent. The 2023 revision and calculation platforms genuinely fixed the arithmetic.

Study 2: 2,549 documents from eight issuers' live endpoints

We then went to population scale: from the full EU instrument register (FIRDS, snapshot 25 July 2026: 8.96 million live structured retail products from 294 issuers, the top 40 of which account for 99.95%), we drew a deterministic stratified sample of 400 ISINs per issuer and retrieved each product's KID from the issuer's own public endpoint, politely and identified.

Study 3: 90 insurer KIDs from 24 manufacturers

Insurance-based investment products are where supervisors found the worst historical numbers: BaFin's 2022 review objected to 34 of 36 insurer KIDs. No FIRDS-style register exists for these products, so we located each insurer's public KID library by hand: 55 documents from 16 German life insurers, 35 from 8 Polish ones, August 2026. Getting the documents was itself a finding: three German insurers publish KIDs only behind interactive portals that block any automated oversight, and one large insurer's documents are findable only through search engines.

Study 4: the defect that only exists between documents

The first three studies each examine documents one at a time, which is how every review we know of is organised. This one does something different: it takes a single share class, meaning one ISIN, one currency and one worked example of the same amount, and puts its language versions side by side.

Twenty products is not a market rate, and thirteen of them come from a single manufacturer. This demonstrates that the defect class exists and is detectable; it is not a frequency estimate and should not be read as one.

What makes this class different is that carelessness is not the cause. Each document is internally correct. Open any one of them alone and it passes every check in the table below. The inconsistency exists only between them, and only if somebody puts them next to each other. A control that reviews documents one at a time cannot catch it by being more careful, and reviewing documents one at a time is how documents are produced, approved and filed.

The pattern: generation is solved. Estates are unowned.

Not one of the material findings in 2,751 documents was a calculation error. Every one was a lifecycle failure: a back-book never regenerated after the rules changed, documents nobody re-reviewed for up to eight years, a feed that stopped tracking the documents it stands behind, a product line whose layout quietly outgrew the page limit.

This is precisely the class of defect that generation-time quality controls cannot see: the platform's job ended when the document was produced, sometimes years ago. Nobody owns the question: is everything we are serving today the document the law requires today? It is also the class of defect that concentrates risk: under Article 11 of Regulation (EU) 1286/2014, a defective KID is a statutory basis for investor damages claims, and under Article 10 of the same Regulation the review obligation attaches to every live product, all 8.96 million of them.

That question has an owner in exactly one place we have found, and it is instructive that the place is a supervisory circular rather than an org chart. In Luxembourg, CSSF Circular 18/698 requires a management company's ongoing monitoring to include verifying that the key information document of every managed UCI adequately reflects the strategy implemented; it requires the procedure to name the department responsible; it expressly rules out delegating that monitoring; and it requires the results to reach the board report. The control must therefore be performed in-house, periodically, on documents the manager did not write, and it must leave evidence behind.

So we looked for the people who do it. Across roughly 1,041 fund-operations job descriptions in Europe, not one lists post-publication monitoring of key information documents as a distinct responsibility. That does not mean the work is never done: where it appears at all, it is absorbed into a wider oversight or production role. The point is narrower, and it is the finding of this report in one sentence. A duty a circular names explicitly, and forbids delegating, is nowhere a post of its own.

What the checks are

Every document is assessed against the same 28 checks, plus one further check on each of the seven prescribed headings wherever that section is located, up to 35 in all. They are listed here in full so that any finding we report can be traced to the rule that produced it, and so that what we do not test is as visible as what we do.

Article references below are to Delegated Regulation (EU) 2017/653 as consolidated at 1 January 2023, the version that carries the template in force, except where another instrument is named.

Two of the 28 are arithmetic; the rest test presence, order and prescribed wording. The arithmetic checks are built for precision over recall: where parsing is incomplete the result is recorded as not applicable rather than guessed, so every arithmetic failure we report can be recomputed by hand from the document itself. Three further checks run conditionally and are not counted among the 28: whether text could be extracted at all, whether the document is in a language we support, and whether that identification was confident.

The last four in the table were added in September 2026 after we mapped our checks against the consolidated text of the delegated regulation and found that we were testing the structure of a document thoroughly and the content elements the articles require hardly at all. They are capped at a warning rather than a failure: they are new, and our first validation run already caught one way they could misfire: a German document naming its supervisor as die Zentralbank von Irland rather than the Central Bank of Ireland. A soft flag a human resolves costs a minute; a hard failure on a compliant document costs more than that.

The last row deserves its own note. Our original date check takes the newest date found anywhere in a document. That is a proxy, and on a sample of 61 documents it disagreed with the date actually printed next to a production or revision label in 13% of cases, by as much as 257 days, always reading the document as fresher than its own label. The new check reads the labelled date instead. We report both rather than quietly replacing one with the other, because the first is the basis of numbers we have already published, and we would rather show the difference than restate a headline figure without showing our working. The direction of the error is worth stating plainly: it means our published staleness rates are a floor, not a ceiling.

Limitations

Study 1 samples manufacturers with publicly downloadable documents, skewing toward better-tooled issuers. Study 2 covers eight issuers whose endpoints serve documents by ISIN; two further top-40 issuers could not be sampled this way, and retrieval misses (matured or non-retail instruments) mean per-issuer rates carry differing confidence. Study 3 has no sampling frame: insurer document libraries were located by manual web research, so coverage skews toward insurers whose documents are publicly findable, and per-insurer document counts are small; per-fund annex documents of multi-option products were classified by hand and not counted as standalone KID defects. Text-based checks measure template conformity, not adjudicated legal compliance; risk-indicator and scenario recomputation from market data was out of scope. The date check is a proxy: it reads the latest plausible date printed in the document, which is not necessarily the date of review, so “past the review window” means more precisely “carries no date newer than 380 days”. That distinction matters more than it looks. Article 15 requires a review at least every twelve months, but Article 16 requires the document to be revised only where that review shows something needs changing, and the date printed under Article 1(e) is the date of production or latest revision, not the date of review. A document reviewed on time and found to need no change keeps its old date and is entirely compliant. So an old date is an indicator worth reporting; it is not evidence of a breach. The claim that does stand on its own is template era: a document still using the cost methodology withdrawn on 1 January 2023 cannot have passed a review conducted since, because Article 15(2)(a) requires that review to test conformity with the form in force. The 380-day boundary itself carries fifteen days of slack because a document dated only “September 2025” is read as the first of that month, which would otherwise flag a document issued at month end up to thirty days early. Rules now exist for eight languages. Seven have been exercised against real documents: German, Polish, English, French, Italian, Dutch and Danish. The Spanish rules have still seen only four. The Dutch rules, described as untested in earlier editions of this report, have since been run against 338 documents; doing so exposed three errors in our own Dutch phrase tables, which were corrected. The French and Italian tables were corrected in the same pass, for a reason worth stating plainly: the consolidated regulation gives two different literal wordings for one prescribed heading in each of those languages, one in the articles and one in the Annex I template. Our tables encoded the article wording, so every French and Italian document following the Annex was being flagged. The Annex is the presentation template, so those documents were correct and the defect was ours, not theirs. Study 4 has the narrowest base of all: twenty products, thirteen of them from one manufacturer, selected by which products we happened to hold in more than one language rather than by any sampling frame. It shows the class exists; it says nothing about how common it is. The job-description count is a search of published advertisements, which describe what an employer hires for and not everything a role performs, so it evidences the absence of a dedicated post and not the absence of the work. We also do not test whether the product description adequately reflects the strategy actually pursued, whether the document is in the language required in the country of offer, or whether the KID agrees with the prospectus. Issuer names are withheld from this public edition; affected manufacturers received specifics before publication, and we share details with any manufacturer about its own documents on request.

The window

The European Parliament is expected to take its first-reading position on the Retail Investment Strategy on 11 November 2026. The current template remains the compliance target until the revised format applies (~2028), after which a machine-readable KID makes document-versus-data verification mandatory infrastructure. The transition itself is the risk event: as Study 2 shows, template changes are exactly when back-books get left behind, and next time, the whole market changes template at once. Every KID in Europe gets reissued, and every estate that is nobody's job today is still nobody's job on the day it matters most.