European Compliance Suite

The Markets in Financial Instruments Directive II is the EU’s primary regulatory framework for investment services and financial markets, applicable since 3 January 2018.

MiFID II applies to investment firms, trading venues, data reporting services, and credit institutions providing investment services across the EU. It governs the conduct of investment business, the operation of trading venues, and the organisational requirements of regulated firms — including the algorithmic systems, automated advice tools, and data-driven investment products those firms use.

MiFID II has been implemented into national law across all EU member states and applies on a passporting basis across the single market.

Yes, where the AI system performs functions that fall within MiFID II’s scope — algorithmic trading, investment advice, portfolio management, suitability assessment, or order execution support. MiFID II does not regulate AI as a technology category; it regulates the activities and the organisational requirements of regulated firms.

Where an AI system performs a regulated activity or supports a regulated firm in delivering one, MiFID II’s requirements apply to that system through the firm’s organisational obligations. AI suppliers to regulated firms face these obligations through their clients’ contractual and oversight requirements.

MiFID II defines algorithmic trading as trading in financial instruments where a computer algorithm automatically determines individual parameters of orders such as whether to initiate the order, the timing, price, or quantity, with limited or no human intervention. The definition is broad — it covers systems that optimise order parameters, not only systems that autonomously execute trades. An AI system that recommends execution timing, optimises order sizing, or selects execution venues based on automated analysis of market conditions is likely within the algorithmic trading definition even where a human approves each recommendation.

MiFID II requires investment firms to obtain information about a client’s knowledge and experience, financial situation, and investment objectives, and to recommend only products that are suitable for that client.

Where AI systems perform suitability assessments, the methodology must genuinely reflect the client’s individual circumstances — not a statistical approximation of a client category. The firm must be able to explain how the AI reached its suitability conclusion for a specific client, to both the client and the regulator. Automated suitability assessments that function as black boxes are non-compliant regardless of their aggregate accuracy.

Investment services AI frequently triggers both MiFID II and EU AI Act obligations simultaneously. AI used in credit decisions, employment, and certain financial services is classified as high-risk under the EU AI Act’s Annex III — requiring technical documentation, conformity assessment, and human oversight measures that overlap with MiFID II’s organisational requirements.

A cross-framework assessment identifies where EU AI Act technical documentation satisfies MiFID II record-keeping requirements, where MiFID II’s suitability methodology documentation contributes to EU AI Act transparency obligations, and where the two regimes impose distinct and non-overlapping requirements on the same system.

DORA and MiFID II both apply to investment firms and both impose ICT risk management, incident reporting, and third-party oversight requirements. DORA is lex specialis for ICT operational resilience — where both apply to the same obligation, DORA takes precedence.

In practice, an investment firm that satisfies DORA’s ICT risk management framework for its AI systems will satisfy the equivalent MiFID II organisational requirements on ICT governance.

The two regimes are complementary rather than duplicative, with DORA providing the more granular ICT-specific requirements and MiFID II providing the investment-services-specific conduct framework.

MiFID II requires investment firms to keep records of all services, activities, and transactions for a minimum of five years — and up to seven years where required by a competent authority. For AI systems, this includes records of algorithm parameters and changes, order generation and modification logs, client communications involving AI-generated content, suitability and appropriateness assessment outputs, and transaction reports.

Records must be kept in a durable medium, be accessible to the competent authority on request, and be capable of reconstruction in the event of system failure. AI systems that do not produce records satisfying these requirements cannot be used in MiFID II-regulated activities.

Third-country investment firms serving EU professional clients and eligible counterparties may operate under MiFID II’s third-country regime — which requires either an equivalence decision for the firm’s home jurisdiction or registration with ESMA for certain activities. Third-country firms serving EU retail clients generally require authorisation in an EU member state.

Non-EU AI companies supplying MiFID II-regulated firms face the same organisational requirements through their clients’ third-party oversight obligations as EU-established suppliers — DORA’s ICT third-party framework applies regardless of the supplier’s establishment.

MiFID II penalties are set at member state level within EU-wide minima. For legal persons, maximum administrative fines reach €5 million or 10% of total annual turnover for the most serious violations. For natural persons, fines reach €5 million.

Competent authorities can also impose public statements identifying the responsible person and the violation, orders requiring cessation of conduct, temporary prohibition of management functions, and — for the most serious violations — withdrawal of authorisation.

The commercial consequence of MiFID II non-compliance — loss of authorisation or restriction of regulated activities — is typically more damaging than the direct financial penalty for an investment firm dependent on its regulatory permissions.

Four steps in order. First, determine whether your AI system performs a regulated activity under MiFID II or supports a regulated firm in performing one — this establishes whether MiFID II applies directly to your organisation or through your clients’ organisational requirements.

Second, assess whether your system meets the algorithmic trading definition — if yes, the most demanding technical controls apply.

Third, assess your suitability and appropriateness methodology, best execution framework, and product governance integration against MiFID II’s requirements.

Fourth, review your record-keeping architecture against MiFID II’s retention and accessibility requirements.

A lawyer-built assessment covers all four steps and delivers a documented compliance position specific to your AI system — mapped against your EU AI Act, DORA, and GDPR position where all apply.