MiFID II
The EU directive that rewrote market structure rules for investment firms — with granular data reporting, best execution documentation, and systems clock synchronization requirements that define modern trading infrastructure.
Markets in Financial Instruments Directive II (2014/65/EU) and its associated regulation MiFIR (600/2014/EU) came into force in January 2018, replacing MiFID I. The directive applies to investment firms, regulated markets, data reporting services providers, and third-country firms providing investment services in the EU. MiFID II introduces pre-trade and post-trade transparency requirements across equity and non-equity financial instruments, mandatory transaction reporting to National Competent Authorities (NCAs) via Approved Reporting Mechanisms (ARMs) within one business day of trade execution, best execution reporting (RTS 27/28 reports, now amended by MiFIR Review), systematic internaliser (SI) obligations, and product governance requirements. Article 26 of MiFIR requires investment firms to report 65 data fields per transaction, including LEIs for counterparties, ISINs for instruments, and timestamps with microsecond precision. The MiFIR Review (Regulation 2024/791) introduced further reforms including consolidated tape requirements and venue transparency changes effective 2024-2025.
The engineering demands of MiFID II are among the most technically specific of any financial regulation. Article 50 of MiFID II Delegated Regulation (RTS 25) requires business clocks used to record reportable events to be synchronized to UTC within defined tolerances: for high-frequency trading (HFT) systems, gateway-to-gateway latency recording must be accurate to 100 microseconds; for voice trading, one-second accuracy is required. This mandates PTP (Precision Time Protocol, IEEE 1588) or GPS-synchronized time sources, atomic clock-based infrastructure for HFT environments, and continuous time drift monitoring. Transaction reporting (Article 26 MiFIR) requires a complete LEI reference data management capability — every counterparty must have a valid, non-expired LEI registered with a Local Operating Unit (LOU), and LEI validation must occur before trade execution, not post-hoc. ARM connectivity requires FIX, ISO 20022, or ANNA DSB-defined schemas depending on the ARM.
MiFID II has significant extraterritorial implications: the equivalence framework for third-country firms means that non-EU firms providing cross-border services to EU clients may be subject to MiFID II obligations depending on ESMA's equivalence decisions. Post-Brexit, UK MiFID (retained in UK law as the UK version of MiFID II, now subject to UK reform through the UK Investment Research Review and FISR) creates a parallel but diverging framework. FCA has made several UK-specific modifications, most notably scrapping the RTS 27 systematic internaliser reporting requirement. For technology firms building trading platforms, MiFID II's product governance requirements (Articles 9-10 of Delegated Directive 2017/593) create obligations for manufacturers of financial instruments to define target markets and perform product approval processes — turning trading system design into a regulated activity requiring governance workflows.
We architect MiFID II-compliant trading infrastructure with PTP-synchronized time sources validated against NIST time services, providing microsecond-accurate timestamps with continuous drift monitoring and automated alerts on tolerance breaches. Our ARM connectivity implementations support multiple ARM schemas (UnaVista, DTCC, Bloomberg ARM) with pre-submission validation engines that check all 65 required fields, LEI validity, and instrument reference data against FIRDS before transmission. We build transaction reporting reconciliation pipelines that match submitted reports against internal trade records, identifying gaps within the T+1 reporting window.
Compliance-Native Architecture Guide
Design principles and a structured checklist for building software that is compliant by default — not compliant by retrofit. Covers data architecture, access controls, audit trails, and vendor due diligence.