MiFID II and MAR,explained

Two regimes, one operating reality

MiFID II is about conduct and market structure. MAR is about abuse. Firms tend to run them together because the evidence overlaps heavily: the same order records, communications archives and surveillance alerts serve both, and the same governance sits over them.

After Brexit the UK onshored both, so a firm operating either side of the Channel typically runs one control set mapped to two rulebooks that have started to diverge in detail.

MiFID II: investor protection

• Client categorisation: retail, professional, or eligible counterparty, with the protections scaling accordingly.
• Suitability and appropriateness: for advice and portfolio management, evidence that the recommendation fits the client, and a suitability report to back it.
• Product governance: manufacturers define a target market and distributors sell into it, with feedback flowing back the other way.
• Costs and charges: aggregated ex-ante and ex-post disclosure, including the effect of costs on returns.
• Inducements and research: tight limits on what can be received, and research paid for explicitly rather than bundled into execution.

MiFID II: execution, reporting and records

Best execution requires you to take all sufficient steps to obtain the best possible result for the client, and to be able to demonstrate it rather than assert it. Transaction reporting under MiFIR requires complete and accurate reports to the competent authority by the end of the following working day, which is where most data-quality remediation projects start.

The records obligation is the one that surprises new entrants: telephone and electronic communications relating to transactions have to be recorded and retained, normally for five years and longer if a competent authority asks. Algorithmic trading brings its own control requirements, including testing, kill functionality and clock synchronisation.

MAR: what it prohibits

MAR prohibits insider dealing, unlawfully disclosing inside information, and market manipulation, and it applies to instruments admitted to trading on regulated markets, MTFs and OTFs, plus certain related instruments. It reaches beyond banks: an issuer with shares on a growth market is squarely in scope.

MAR: what it makes you do

• Disclose inside information to the market as soon as possible, or record a valid delay with the reasons and the timeline.
• Maintain insider lists, kept current and precise about who knew what and when.
• Manage transactions by persons discharging managerial responsibilities and people closely associated with them, including notification and closed periods before results.
• Run surveillance and file suspicious transaction and order reports where there is a reasonable suspicion.
• Follow the market-soundings procedure when information is passed to potential investors ahead of a transaction.

How it relates to security frameworks

The overlap with ISO 27001 and SOC 2 is real but partial. Retention and integrity of records, access control over inside information, logging, change control over trading and surveillance systems, and vendor oversight all map across cleanly. What does not map is the conduct substance: suitability, best execution, target markets, and the reporting obligations. A sensible approach is to satisfy the shared controls once and treat the conduct requirements as their own layer on top.