Founders building anything close to investment advice, trading, or financial data reporting eventually hit the same question: what is MiFID II, and does it actually apply to a business like theirs?
In short, MiFID II is the rulebook behind most regulated investment activity in the UK and EU, and whether it applies to you comes down to what your business does, not its size or its "fintech" label. Here's what the regulation covers, how Brexit changed it, and what actually triggers compliance.
What Is MiFID II (and UK MiFIR)?
MiFID II is the EU's Markets in Financial Instruments Directive, paired with MiFIR, forming the core rulebook for investment services in Europe since 3 January 2018. Legally, that's Directive 2014/65/EU and Regulation (EU) 600/2014, published in the Official Journal on 12 June 2014. It replaced the original MiFID, in force since 2007, after the 2008 financial crisis exposed how thin investor protection and market transparency really were.
Answering what is MiFID II in practice means looking at two working parts, not one document. The Directive sets the broad structural obligations of client categorisation, suitability and appropriateness checks, best execution, conflicts of interest, product governance, rules on inducements. MiFIR is the more technical half: pre- and post-trade transparency, transaction reporting, and rules for trading venues. Strip away the directive numbers, and that's the MiFID II meaning in one line a conduct-and-market-structure regime built around what a firm does, not what it's called.
UK MiFIR is the version that actually governs a UK startup. It's the UK's implementation of the same MiFID II and MiFIR framework, and for a business operating here, it's the one that matters day to day.
How Brexit Changed the Rules
MiFID II still applies in the UK after Brexit; it just runs under UK law now, not EU law. The European Union (Withdrawal) Act 2018 created a body of "retained EU law" based on what applied in the UK on 31 December 2020, so since January 2021 there's effectively been an EU version of MiFID II and a UK version, running in parallel with substantially the same obligations. The onshoring didn't touch the MiFID II meaning underneath same conduct rules, different legal wrapper.
That wrapper has since started to change, though. The Financial Services and Markets Act 2023 gave HM Treasury and the FCA power to properly rewrite, rather than just onshore, this "assimilated law." The Share Trading Obligation that came out of MiFID II regulation was fully revoked from 29 August 2023, meaning UK firms are no longer tied to trading UK-listed shares only on specific regulated venues. That rewrite programme, sometimes called the Wholesale Markets Review, is still running.
One thing worth flagging: the EU's own update, MiFID III, entered into force in March 2024, with member states required to transpose it by September 2025. That's an EU-only change; it doesn't automatically apply in the UK, and the two shouldn't be confused. The UK is on its own reform track now, separate from Brussels.
What Triggers It: Advice, Execution, Data Reporting
Investment advice, order execution, and data reporting trigger MiFID II compliance not simply operating in fintech. Working out what is MiFID II compliance for your specific business starts with checking whether you do any of these three things:
Building the tech that regulated firms use a trading platform, a market data tool, a risk engine doesn't automatically bring you into scope under MiFID II regulation. The obligation sits with the regulated firm using your product to manage and oversee it; you only get pulled in through contractual and outsourcing arrangements, not by default.
There's also a lighter path. The Article 3 "MiFID optional exemption" covers firms that don't hold client money or securities, and only provide order transmission or investment advice on transferable securities and fund units. It's genuinely relevant to some financial advisers, corporate finance advisers, and venture capital firms. An Article 3 firm still needs FCA authorisation, but the process is markedly less intensive than full MiFID authorisation.
What the FCA Actually Checks
The FCA checks threshold conditions, effective supervision, appropriate resources, suitable management, and a viable business model before granting the Part 4A permission a MiFID investment firm needs to operate. In practice, that means a detailed regulatory business plan, a compliance framework, and financial projections, with applications commonly taking several months to work through (industry estimates put it around 6–12 months; the FCA doesn't publish a fixed figure, so treat that as a planning guide rather than a guarantee).
Capital sits under a separate check: the Investment Firms Prudential Regime (IFPR), in force since 1 January 2022. It splits firms into two tiers:
- SNI firms ("small and non-interconnected") — the FCA has estimated roughly 70% of firms fall here, below set permission and turnover-style thresholds.
- Non-SNI firms — everyone above those thresholds, plus any firm with permission to deal as principal, regardless of size.
Every in-scope firm, whichever tier, has to run an internal capital adequacy and risk assessment (ICARA) on an ongoing basis not a one-off box to tick at authorisation. None of this changes what MiFID II is at its core: a conduct regime keyed to activity, not headcount.
Do Most Startups Need to Worry?
Most early-stage UK startups don't need full MiFID II authorisation unless they're directly advising on, executing, or reporting trades in financial instruments; the "fintech" label alone doesn't put you in scope. A robo-advisor or a trading app plainly is a MiFID business. A payments app, a lending platform, or a B2B SaaS tool selling into regulated firms usually isn't, unless it starts arranging or executing deals itself.
Working out what is MiFID II for your own product comes down to what it does, not what sector it sits in. Giving personalised recommendations on financial instruments, executing orders, or reporting transaction data on someone else's behalf brings MiFID II regulation into play, and it's worth a compliance read before scaling, not after. Building infrastructure that regulated firms plug into is more likely to bring obligations through the contract than through your own authorisation but check the contract, not just the sector.
Conclusion
So, what is MiFID II for a UK startup, in practice? A conduct-and-transparency regime that only bites once a business crosses into advice, execution, or reporting on financial instruments, not something triggered by size, funding stage, or the word "fintech" on your pitch deck. Most founders reading this will confirm they sit outside that line and move on; the ones inside it should treat FCA authorisation, or the Article 3 exemption, as next on the list, not an afterthought.
FAQs
1. Does MiFID II still apply after Brexit?
Yes. It was onshored into UK law via the European Union (Withdrawal) Act 2018 and now runs as UK MiFIR alongside the EU's own version, with substantially the same core obligations. Since 2023, the UK has also started actively diverging from the EU version the Share Trading Obligation, for example, was scrapped entirely rather than just onshored.
2. Who does MiFID II apply to?
It applies to firms providing MiFID investment services dealing, advising, arranging, executing, or managing in relation to financial instruments plus data reporting service providers such as ARMs and APAs. Fintech platforms offering advice or execution are typically in scope; pure technology vendors supplying tools to regulated firms usually aren't, unless drawn in by contract.
3. What triggers MiFID II compliance for a startup?
Providing investment advice, executing client orders, receiving and transmitting orders, or operating as a data reporting service provider. Firms doing limited advice or order transmission without holding client money may qualify for the lighter Article 3 exemption route instead of full FCA authorisation.
Also read: Beyond the Cheque: How UK Corporate Venture Capital Actually Works
Sources: European Commission Official Journal (Directive 2014/65/EU; Regulation (EU) 600/2014); FCA (Handbook PERG 13, IFPR guidance, Data Reporting Services Providers pages, MiFID II retail investment advice firms page); HM Treasury and legislation.gov.uk (European Union (Withdrawal) Act 2018, Financial Services and Markets Act 2023); Norton Rose Fulbright, Sidley Austin, and Proskauer regulatory briefings. Figures reflect the most recent available data at the time of writing.
The EP+ Editorial Desk covers UK startups, founder stories, and venture capital. All editorial content is independently produced and human-reviewed before publication.
