An active breach is an investment limit broken by something the manager did, or could have avoided: a purchase, a sale, a maturing bond left as cash, a check that was never run. A passive breach is a limit broken by something outside the manager's control: market prices, subscriptions and redemptions, a compulsory corporate action, a change in a security's characteristics. Active breach vs passive breach is a question of cause, not of size, and it is answered when a post-trade alert turns out to be real. The answer then decides everything that follows: how fast the cure must be, whether the fund is compensated, and who must be told. Botminds' Investment Guideline Monitoring is built for that decision: its agents recompute each overnight alert from the custodian position and the governing clause, gather the trades, flows and price moves behind it, and an analyst classifies the breach with that evidence for the Head of Investment Compliance to approve.
The regulatory material on this page comes from Luxembourg's CSSF and from France's AMF, which inspected how five asset managers monitor, classify and compensate their breaches between 2021 and 2023. Examples marked as sample come from the solution's fictional sample manager, Quillfield Capital, and its fictional clients.
What the AMF found when it counted breaches by cause
4×
as many passive breaches as active ones across the five managers inspected
14–34%
share of breaches classified active, manager by manager
4%
of active breaches led to compensation, on average
5days
working days after which all five reclassify an uncured passive breach as active
Active breach vs passive breach: the test is cause, not size
The test is who or what moved the portfolio over the line. Luxembourg's Circular CSSF 24/856, in force since 1 January 2025, makes it the first question after any breach is found: the fund or its manager "must determine whether such non-compliance is “active” or “passive”" (point 54). It then defines passive as arising for reasons beyond the fund's control or from the exercise of subscription rights, and active as everything that cannot be so qualified (point 55). The burden sits on the passive side: a breach is active unless the manager can show it was not.
France's AMF found the five managers it inspected applying the same idea through a short list of grounds. A breach is active when it comes from a management decision or from something the manager should have seen coming; it is passive when it comes from the market, the fund's flows, the issuer or the fund's own fee provisions. The table below is the AMF's, reorganised as a comparison.
The grounds that make a breach active or passive
Active: the manager's doing: A voluntary management action: the purchase or sale that took the fund over the limit.
Passive: outside the manager's control: Market movements that change a holding's weight with no trade.
Active: the manager's doing: A security repaid and not reinvested on time, leaving an excess cash balance.
Passive: outside the manager's control: Subscription and redemption movements that change the fund's size.
Active: the manager's doing: Prohibited securities received through a fund merger that should have been checked first.
Passive: outside the manager's control: A compulsory corporate action, or a change in the investment universe.
Active: the manager's doing: An avoidable overdraft, or a settlement date entered wrongly.
Passive: outside the manager's control: Changes in fee provisions that move the base a ratio is measured on.
Two consequences follow from reading cause rather than outcome. First, the same limit can be broken actively in one fund and passively in the next on the same day. Second, the label can change over time: a passive breach that the manager leaves uncorrected for long enough stops being the market's breach and becomes the manager's, and the five French managers wrote that rule down.
What is a passive breach? The meaning regulators give it
A passive breach is a contravention of an investment limit that occurs without a decision by the manager, typically because prices moved, the fund's net assets changed through subscriptions or redemptions, or subscription rights were exercised. The UCITS Directive is the origin of the idea: when limits are exceeded for reasons beyond the fund's control or through subscription rights, the fund must make remedying the situation a priority of its sales while taking account of unit-holders' interests (Directive 2009/65/EC, Article 57(2)).
The CSSF's standard example is a fall in market prices that shrinks the net asset value against which a restriction is measured. That example matters because the breach can appear in a holding the manager never touched: a 9.6% position becomes 10.2% when the rest of the fund falls. Passive does not mean harmless, and it does not mean the clock is off. In Luxembourg a passive breach must still be corrected within a reasonable period in investors' interest and watched by the fund's directors until it is. The cure clocks by regime, from the UK's six months to the US rules on illiquid investments, are set out in the guide to passive breach of investment limits; this page stays with the classification itself.
France adds a precision that changes how cash breaches are labelled. The AMF's quarterly reporting rule excludes from the active count only breaches "occurring beyond the control of the asset management company and not resulting from the maturity of a financial instrument held by the UCITS" (AMF General Regulation Article 321-75-1, quoted in the AMF summary). A bond maturing into cash is, by that wording, the manager's breach: the date was known.
Active breach vs passive breach examples: twelve cases, classified
Most breaches classify themselves; the hard ones sit where a market event meets a management choice. The cases below are typical of a post-trade queue. Each label follows the CSSF definitions and the AMF's grounds; where a case turns on a detail, the detail is named.
Twelve breaches, and why each is active or passive
| What happened | Label | Why |
|---|---|---|
| An equity rally lifts one issuer from 9.6% to 10.4% of net assets | Passive | Market movement, no trade. Buying more of the issuer afterwards would be a voluntary act, and active. |
| Large redemptions shrink the fund and push the cash or an issuer weight over a limit | Passive | Liability movement. Active instead if the redemption was known and the manager did nothing, which point 56 calls foreseeable or avoidable. |
| A bond matures and the cash sits above the fund's cash limit | Active | The maturity date was known; the AMF lists "repayment of a security not renewed on time" as active, and France excludes maturity from the passive carve-out. |
| The manager buys a replacement bond days before the old one matures, and interim inventories show both | Active, often a false positive | The AMF's example of an overrun caused by settlement timing; one manager's policy treats it as a false positive to be evidenced, not a breach. |
| A fund merger delivers securities the receiving fund may not hold | Active | The AMF lists it as active where risk control had to validate eligibility before the merger. |
| A compulsory corporate action delivers shares in a spun-off company | Passive | Compulsory corporate actions are on the AMF's passive list. Keeping the shares past the cure period is not. |
| An ESG rating change moves a holding into the fund's exclusion list | Passive | A change in the security's characteristics. Every purchase after the change is active. |
| Fee provisions are booked and the lower net assets lift an issuer over its cap | Passive | "Changes in provisions" are on the AMF's passive list. |
| Sample: a purchase takes a client over a 5% issuer cap because the security master lacked a guarantor link | Active | Ostrander State Teachers' Retirement System, 5.42% against 5.00%. An IT or data failure is still the manager's act (CSSF point 56). |
| Sample: the IT sector rises 4.1% with no IT purchases, and a client's 35% sector limit is passed | Passive | Kitami Prefectural Mutual Aid Association, 35.8% against 35%. Its own guidelines then set a 10-business-day cure. |
| A passive breach is still open after five working days without remediation | Active | All five managers the AMF inspected reclassify it automatically. |
| A daily-NAV fund's cash account stays overdrawn | Active by default from the 6th NAV | One inspected manager's policy treats it as proven and active from the 6th NAV in breach (2nd for a weekly NAV). |
Three of the twelve turn on time rather than on the event. The maturing bond, the overdrawn cash account and the uncured passive breach are all cases where nothing new happened on the day the label changed: the manager simply had long enough to act. That is why a classification needs a date as well as a reason, and why the reason has to be written down when the breach is confirmed, not reconstructed at quarter-end.
Who decides the label, and on what evidence?
The risk or compliance function decides, on a written list of criteria, and the decision should be traceable to the evidence it rests on. At the managers the AMF inspected, the criteria covered the transactions behind the breach (buy or sell, amount, date placed, settlement date), movements in the fund's liabilities, cash events such as maturities, dividends and coupons, market moves, changes in a security's characteristics such as an ESG rating or a corporate action, and fee provisions. One manager's risk managers assigned each alert as active or passive by hand in a central alert repository it built in July 2022, which also became the source for its regulatory reporting.
Two findings show where the decision is weakest. The AMF called it poor practice to fail "to formalise the rules for distinguishing between active and passive overruns" in the monitoring procedure, and one of the five did not distinguish them at all. And even where the rules existed, the AMF saw room for improvement in the audit trail of the manual steps, "in particular to the due justification of reclassifications of overruns (passive to active)" (AMF summary, §4.3).
How Investment Guideline Monitoring prepares the active-or-passive call
Agent
Triage agentRecomputes the alert from the custodian position and the clause, and lists the trades, flows and price moves since the last compliant valuation.
Never: Never classifies on its own authority
Agent
Data Check agentRe-sources the price, rating, sector or corporate action behind the move from a second source.
Never: Never picks a winner when sources disagree
Agent
Agreement agentFinds the clause, any cure period and notice duty in the agreement or prospectus, page-cited.
A person decides
Compliance analystClassifies the breach as active or passive with a reason code, on that evidence.
A person decides
Head of Investment ComplianceApproves the classification; no one approves their own.
How long do you have to cure a passive breach in practice?
Rarely as long as people assume. The EU text sets no fixed period, and Luxembourg asks for correction within a reasonable period in investors' interest, but managers turn that into a number, and the number is short. All five managers in the AMF's inspection "provide for the automatic reclassification of a passive overrun as an active overrun after five working days without remediation" (AMF summary, §4.3.3). For all five, the rule was that management starts the remediation from the first NAV after the one on which the breach was identified.
The escalation ladders behind those rules are tight as well. One manager escalates a daily-NAV breach to the head of the management unit and the compliance officer after two NAVs if active and three if passive, and to general management after six and seven. Client agreements often set their own period: in the sample data, Kitami Prefectural Mutual Aid Association's Japanese guidelines require the manager to "promptly report to the Client and correct it within 10 business days" when a limit is passed for reasons not attributable to it. The solution's default setting for passive breaches, a cure within 15 business days unless the agreement says otherwise, gives way to that clause.
A passive breach read in the client's own language
Does a passive breach have to be reported, and to whom?
Usually not to the regulator, but often to someone. In Luxembourg, passive breaches sit outside the circular's correction and compensation sections and are not notified to the CSSF; the fund's directors monitor them until they are corrected (point 55). In France, the quarterly report every manager has sent the AMF since the third quarter of 2021 lists active breaches only, using the carve-out quoted above.
Clients and delegating managers are a different matter. An investment management agreement may require notice of any guideline exception, whatever its cause, and the Kitami clause above is one that requires a report even for a passive breach. In delegated management, the AMF found that the agreements it reviewed limited ad hoc notices to the delegating manager to active breaches, while periodic reporting covered both. Who hears about which breach, and on which clock, is the subject of the guide to investment breach notification requirements.
Active breach under the CSSF circular: corrected, priced and paid
An active breach in a Luxembourg fund must be corrected straight away for UCITS and other funds in liquid assets, and any loss to the fund must be made good. The circular is specific about the money. Where the breach caused a loss, the fund "must be compensated to the extent of the loss suffered" (point 70); "The tolerance thresholds for NAV calculation errors cannot be applied in this case" (point 71); and where the calculation shows a profit, "this profit must remain with the UCI" (point 75). By default the impact is measured with the accounting method, the gain or loss realised between the trade that caused the breach and the trade that cured it (points 78 and 79).
The AMF found one of the five French managers doing exactly what the CSSF rules out: triggering compensation only above the materiality thresholds it used for NAV errors, 0.25% to 1% of net assets depending on the fund. The AMF called that inappropriate, because an active breach has a financial impact whether or not investors traded, unlike most NAV errors. Another manager compensated from the first euro of loss, and a third set its threshold at 0.04% of net assets and more than €10,000.
Compensation for breaches is rare, and usually small
€800
paid by one manager for breaching a short-selling prohibition in an equity fund
€10–48k
range of ten payments by another, mostly for missing or wrongly configured pre-trade checks
€350–500
four payments for two passive cash breaches that became active when the cure deadline expired
Why the label is worth getting right
Because a passive label saves money and paperwork, and an examiner knows it. The AMF's news release explains why compensation is rare: "the volume of active breaches observed on the panel is four times lower than that of passive breaches", and on average "compensation is only paid in relation to 4% of the active breaches" (AMF, 19 February 2025). A manager whose passive share is far above its peers', or whose passive breaches regularly outlast their cure period, is inviting the question of whether some of them were the manager's.
The cost runs the other way too. A breach wrongly called active sends a notice, a compensation calculation and a remediation trade that the fund did not need. The AMF also found that retail investors rarely complain about ratio breaches, because they do not see them: none of the claims the five managers received concerned a ratio. The classification is therefore one of the few places where the investor's interest depends almost entirely on the manager's own honesty and care, which is the AMF's reason for asking for a robust internal process even in the absence of a claim.
Active and passive breaches side by side in one register
Where Investment Guideline Monitoring supports the call, and where it stops
Investment Guideline Monitoring does not decide the label. It assembles what the decision needs: the recomputed position, the transactions and flows since the fund was last compliant, a second source for every price, rating and sector code, and the clause that governs the limit, cure and notice. The analyst classifies, the Head of Investment Compliance approves, and the reason code and evidence stay with the breach for the quarterly report, the board and the examiner. In the sample data, the Ostrander purchase is classified active within minutes of the overnight run, and the Kitami sector breach is classified passive with the client's own clause on screen.
Two adjacent problems belong elsewhere. Stopping the next order from turning a passive breach active is a pre-trade job, covered in the guide to pre-trade vs post-trade compliance. Fixing a coded rule that fires on the wrong measure, such as a credit floor coded on the lowest rating when the agreement uses the middle one, belongs to the team that codes the rules; the solution drafts the fix with the clause attached, and the people who own the coded rules decide it, ideally after backtesting both readings.
Questions people ask
What is a passive investment breach?
A passive investment breach is a limit broken without a decision by the manager: prices moved, the fund grew or shrank through subscriptions and redemptions, subscription rights were exercised, or a compulsory corporate action changed a holding. It must still be corrected within a reasonable period in investors' interest, and buying more of the same exposure while it is open makes it active.
Is a breach caused by a bond maturing active or passive?
Active, under both French and Luxembourg practice. The maturity date was known, so leaving the proceeds as excess cash is the manager's inaction; the AMF lists "repayment of a security not renewed on time" among its active grounds, and the French reporting rule excludes maturity from its passive carve-out.
Can a passive breach become active?
Yes, in two ways. A purchase that adds to the breached exposure is a voluntary act and makes it active at once, and an uncorrected passive breach turns active with time: all five managers the AMF inspected reclassify one automatically after five working days without remediation.
Is a passive breach ever compensated?
Not as a passive breach: in Luxembourg passive breaches fall outside the circular's compensation sections. But the AMF found one manager paying four compensations of €350 to €500 for two passive cash breaches that had become active when their procedural deadline expired.
Do active and passive breaches apply to segregated mandates as well as funds?
The CSSF and AMF rules apply to funds, and the AMF's inspection expressly left mandate ratios out of scope. For a segregated mandate the investment management agreement decides: it may define the two kinds and set a cure period and a notice duty for each, and some, like the sample Japanese client's guidelines, require a report even for a passive breach.
Who should classify a breach as active or passive?
The risk or compliance function, not the portfolio manager whose trade is in question, on written criteria. At the managers the AMF inspected, risk control had the final word in any disagreement with management, and the AMF asked for each passive-to-active reclassification to be justified in the audit trail.