MiFID II
Definition
MiFID II
MiFID II is the European Union’s Markets in Financial Instruments Directive, the rulebook for investment firms, venues and market data. It reaches outsourcing, because a firm that contracts out an important operational function keeps every obligation attached to it.
The directive applied from January 2018 and rebuilt European market structure around transparency, investor protection and documented decision making.
Its outsourcing provisions are short — and unforgiving, because they refuse to accept that handing work to a supplier hands over the duty that came with it.
The rulebook has since moved. Directive (EU) 2024/790 amended it, and member states had to transpose the changes by 29 September 2025.
Key takeaways
- MiFID II treats outsourcing as an organisational matter, not a procurement one.
- Important operational functions attract the strictest treatment and the heaviest documentation.
- A firm remains fully responsible for obligations it has contracted out.
- The 2024 amending directive changed reporting and market structure, not the outsourcing principle.
How it works
The directive divides outsourced work into two categories. Ordinary supplier arrangements attract general governance expectations, while important operational functions attract specific conditions on diligence, oversight, continuity and the regulator’s right to look.
A function is important when getting it wrong would materially impair the firm’s regulatory compliance, its financial soundness or the continuity of its services. That test is qualitative, which means somebody has to make the call and be able to explain it.
The United Kingdom’s onshored version of the rule states the principle plainly.
A firm must not undertake the outsourcing of important operational functions in such a way as to impair materially the quality of its internal control, and it remains fully responsible for discharging its obligations.
| What you outsource | What MiFID II expects |
|---|---|
| Important operational function | Documented risk assessment, written agreement, ongoing oversight, exit plan |
| Client order handling | Best execution evidence you can reproduce yourself |
| Record keeping and call recording | Retention and retrieval within your own regulatory deadlines |
| Market data and reporting | Accuracy you can verify, not accuracy you were promised |
| General support services | Proportionate governance under your wider supplier framework |
The practical consequence is that oversight has to be real. A quarterly service review with a green dashboard is not evidence that you supervised an important function.
Regulators also expect the arrangement to be reversible — if your provider fails, you need a plan that restores the function without a gap your clients can feel.
Examples
Investment firms outsource far more than they admit in their annual reports. The arrangements below are all live, and each survived a regulator asking about it.
A Dublin-authorised broker runs trade confirmation and settlement support from Manila. Because the function is important, the firm keeps its own reconciliation controls and can rebuild the process in house within a defined window.
A Frankfurt asset manager contracts client onboarding checks to a specialist in Krakow. The manager still owns the suitability decision, and it tests a sample of the vendor’s files every month rather than accepting the vendor’s own quality score.
An Amsterdam trading firm uses an external provider for regulatory reporting. When a field mapping error produced months of inaccurate submissions, the regulator addressed the firm, not the supplier — the reporting obligation had never moved.
A Paris wealth manager outsources call recording to a cloud telephony provider. The contract gives the firm direct retrieval rights, because a request for a recording arrives with a deadline the provider’s support queue would not meet.
Related terms
Several rules sit alongside this directive and get cited in the same procurement documents. The terms below sit close to this one, and the distinctions matter in practice.
- Digital Operational Resilience Act (DORA): the EU regime governing technology suppliers to financial entities.
- Regulated outsourcing: outsourcing inside any supervised sector, of which this is one instance.
- Compliance outsourcing: contracting out the compliance function itself rather than an operational one.
- Vendor management outsourcing: running the supplier programme, which supervisors expect you to own.
- Service level agreement (SLA): the performance contract, which is necessary but never sufficient here.
- Risk outsourcing: moving risk activity to a provider, which does not move the risk itself.
- Banking, financial services and insurance (BFSI): the sector this directive sits inside.
FAQ
Does MiFID II ban outsourcing?
No. It permits outsourcing of any function, including important operational ones, provided the firm meets the conditions and keeps control of the outcome.
What makes a function important?
Failure would materially impair regulatory compliance, financial soundness or service continuity. The assessment is the firm’s own, and it should be written down before the contract is signed.
Can a provider accept regulatory responsibility?
No. The authorised firm holds the permission and answers for the obligations. A contractual indemnity moves money after the fact and moves nothing before it.
Does offshore delivery create a problem?
Not by itself. It raises the bar on oversight, data access and continuity planning, and supervisors expect those points addressed rather than assumed.
What changed in the 2024 amendments?
The changes centred on market structure, consolidated tape, payment for order flow and best execution reporting. The organisational rules on outsourcing were left intact.
Does the UK still follow MiFID II?
The UK onshored the regime and has since diverged in places. The outsourcing principle in SYSC 8 still mirrors the directive closely.
Compare verified partners in the Outsource Accelerator directory and shortlist the firms that already work under this regime.
Independent
