Vixio Intelligence
To keep up to date on Vixio webinars, events and industry and product news,
sign up today
Subscribe NowDiscover the best MiFID II compliance tools for 2026. Learn how regulatory change management helps firms track EU updates, NCA guidance, and audit trails.
If you work in compliance at an investment firm, broker, credit institution, or payment company operating under the Markets in Financial Instruments Directive II (MiFID II), some of these challenges might sound familiar:
To help you find a solution, we'll break down what you need to look for in a MiFID II compliance tool. We'll go into depth on regulatory change management, a solution that gives compliance teams a reliable way to track and manage regulatory changes, and streamline internal processes.
In this article:
Vixio is a regulatory change management platform built specifically for financial services, payments, and gambling compliance teams. Book a demo to see how it works for you.
MiFID II is the directive that governs firm conduct, investor protection, and the authorisation of investment firms. As a directive, it requires national transposition, meaning each EU member state must incorporate it into domestic law. That process introduces variation, and permitted differences (national discretions) mean the same underlying requirement can look meaningfully different depending on where you operate.
Then we have MiFIR, which is the regulation that sets out transparency and reporting requirements for how markets actually operate. Because it's a regulation rather than a directive, it applies directly across the EU without transposition. This makes it more uniform in theory, but no less complex in practice.
MiFID II isn't just one regulation to track. It's a constantly expanding body of secondary legislation, national transpositions, and regulator guidance that stretches across 27 EU member states and underpins financial markets.
As a result, staying current with MiFID II requires monitoring dozens of sources simultaneously, interpreting how requirements apply differently across jurisdictions, and tracking deadlines that vary by member state.
Most compliance teams are doing this manually, and as a result, it can be difficult to catch everything that matters.
MiFID II has a wide reach across the European Union financial system.
If your business deals in financial products or financial instruments (shares, bonds, derivatives), MiFID II almost certainly applies to you in some form.
MiFID II is unusually prescriptive. The European Commission's list of current secondary regulations alone runs more than ten pages long. On top of that, every national competent authority in every member state can publish its own guidance, in its own language, on its own schedule.
Also, individual national competent authorities in all member states can and do publish their own guidance.
For example, the Finnish Financial Supervisory Authority regularly updates its regulations and guidelines for alternative investment fund managers and investment firms, including rules on authorisation, ownership and governance. This kind of update is easy to miss if you aren’t actively monitoring the Finnish regulator’s website.
National discretions compound the problem further. Member states are permitted to deviate from certain requirements within defined limits.
Payment for order flow is a live example. There's a general EU ban on brokers receiving payments for directing clients to specific trading platforms, but Germany was permitted to defer application until June 2026.
When you multiply that kind of discretion across seven or eight permitted deviations and over two dozen member states, and the tracking challenge becomes clear.
Sometimes referred to as MiFID III, the MiFID review is an enhancement of the current regime rather than a replacement. It focuses heavily on transparency around payment for order flow, data reporting requirements, and call recording rules.
New delegated regulations triggered by the review have already started entering into force in 2025 and 2026, which means firms are dealing with new compliance obligations and deadlines right now, not at some future point.
Looking further ahead, several live or incoming EU regulatory developments may affect firms in scope of MiFID II:
Firms that use regulatory change management platforms now are better placed to absorb these without starting from scratch each time.
Most compliance teams managing MiFID II don't have a regulatory change management tool. What they have instead is a collection of email alerts, bookmarked websites, and informal arrangements where someone is loosely responsible for checking what's new.
That works until it doesn't.
When a new delegated regulation lands, the typical process looks something like this: someone spots it, forwards it to the right person, and hopes it gets picked up. There's no:
If a regulator later asks what your firm did about a specific ESMA guideline or NCA publication, you're reconstructing the answer from inboxes and spreadsheets.
The reason this matters more now than it did five years ago is volume. MiFID II isn't generating one or two significant updates a year. The MiFID review alone is producing a continuous stream of delegated regulations, NCA guidance, and ESA guidelines, each with its own implications, its own timeline, and in some cases its own language.
Tracking all of that manually across 27 member states, while managing day-to-day compliance work, is difficult without an automated tool. And because there's no audit trail, you often don't know something was missed until a regulator asks about it.
A regulatory change management tool changes the structure of that process entirely. Whether it's a new delegated regulation from the MiFID review or guidance from a national competent authority, the tool:
When a regulator asks what your firm did about a specific update, you're not piecing together an answer from old emails: it’s already documented.
Before comparing specific platforms, it's worth establishing what good looks like for this category.
Vixio is a specialist regulatory intelligence platform that has tracked global regulatory change across financial services, payments, and gambling for nearly 20 years. It combines AI-powered monitoring with in-house analyst expertise across 200+ jurisdictions.
Here's how the platform helps compliance teams:
Compliance teams aren't just tracking ESMA and the European Commission. They're tracking implementing regulations, delegated regulations, ESA guidelines, and NCA-level publications across every member state they operate in, and in multiple languages.
To make sure you get all the intelligence you need, Vixio's SCANS technology monitors 1,600+ regulators and 6,200+ curated sources. Then, our specialist EU financial services analysts determine scope, materiality, and publication readiness as part of the core intelligence process to ensure accuracy.
VIQ queries only Vixio's curated regulatory library, so every answer links back to a primary source rather than the open web.
The MiFID review is generating a steady stream of new delegated regulations, each with its own deadlines and compliance implications. Knowing something has been published is only the first step.
Vixio categorises every update as Actionable, Indicative, or Informative so your team knows what they need to take action on immediately.
Then, the Smart Inbox is personalised to your specific licences, jurisdictions, and business lines, so the feed is relevant from the moment you log in and your team isn’t drowning in updates that don’t actually matter to them.
When a national competent authority publishes guidance that affects your firm, that update needs to become a task with an owner, a deadline, and a record of what was done. Most teams have no reliable way to make that connection automatically.
Vixio Workspace lets teams create tasks directly from regulatory updates, with ownership, deadlines, and status tracked in one place. The audit trail builds automatically, so when a regulator asks what was done about a specific ESMA guideline, the answer is already there.
MiFID II doesn't sit in isolation, and firms managing investment compliance are also managing DORA, preparing for PSD3, tracking the AML regulation package, and monitoring MiCA if they have any exposure to digital assets.
Vixio covers all of these on the same platform, so as the EU regulatory calendar adds new requirements, teams don't need to add new tools.
Envestnet | Yodlee, a global leader in open banking, data aggregation, and analytics trusted by more than 1,400 financial institutions, integrated Vixio's Horizon Scanning into their compliance framework as they expanded their global operations. The platform gave their team a way to map regulatory requirements by country and surface the sections that matter without manually tracking dozens of sources.
Here’s what Principal Director of Open Banking Compliance for EMEA, Kat Cloud, had to say about Vixio:
“One of the standout things that we've seen is that Vixio is actually addressing that the market is growing, the market is changing, and that they need to provide different products and services to their clients that continue to be useful. It’s so nice to see that they’re actually listening to their clients.”
Read the full case study: Envestnet | Yodlee navigates global compliance with Vixio horizon scanning
MiFID II doesn't get simpler as your firm expands into more member states. The national discretion problem compounds, the volume of secondary regulation increases, and the MiFID review is adding new obligations on top of an already complex baseline, at exactly the point that leadership expects compliance to move faster.
Vixio gives your compliance team a more scalable way to manage that complexity, combining AI-powered monitoring across the European Commission, ESMA, EBA, and all relevant national competent authorities with analyst-validated intelligence. This intelligence covers both primary regulation and national transpositions and discretions. Finally, you get connected workflows for turning regulatory updates into managed, auditable compliance tasks.
Book a demo to see how Vixio tracks MiFID II regulatory developments and helps your team stay ahead of the MiFID review.
MiFID II is the directive that governs firm conduct, investor protection, and the authorisation of investment firms and requires national transposition into domestic law in each EU member state.
MiFIR is the regulation, setting out the transparency and reporting requirements for how markets operate and applies directly across the EU without transposition.
The practical difference is that MiFIR obligations are more uniform across member states, while MiFID II obligations can vary depending on how each country has transposed the directive and which national discretions it has applied.
MiFID II’s scope is broad. It covers:
If your business deals in financial instruments (shares, bonds, derivatives, structured products), MiFID II is likely to apply in some form. The specifics depend on your business model and the jurisdictions you operate in.
The MiFID review, sometimes called MiFID III, is an enhancement of the current regime rather than a replacement. It focuses primarily on transparency, including:
New delegated regulations triggered by the review have already started entering into force in 2025 and 2026, meaning firms are dealing with new compliance deadlines right now. The review is ongoing, and further delegated regulations are expected.
Broadly, there are four categories:
Most firms need tools from more than one category. Regulatory change management is the area where most investment compliance teams are still relying on manual processes, which is where the most significant unaddressed risk tends to sit.
MiFID II as a directive permits member states to deviate from certain requirements within defined limits. There are approximately seven or eight areas where such deviations are currently permitted, and each can apply differently across 27 EU member states.
The payment for order flow ban is a current example:
For firms operating across multiple EU countries, tracking which deviations apply in which jurisdictions, and when any deferral periods expire, requires either a significant manual effort or a tool specifically designed to track member state-level implementation.
