Financial AtlasTo the mapУкраїнська

REGULATION & SUPERVISION

Financial Market Infrastructure

Watches that trading stays honest and the market's plumbing does not break.

Open on the interactive map →

This page is the text version of one zone of the interactive map.

Its role in the system

Makes sure capital markets are fair, transparent and unbreakable. The market regulator licenses exchanges, brokers and asset managers, forces companies to tell investors the truth, investigates manipulation and insider dealing, and — together with the central bank — oversees the market's plumbing: central counterparties (CCPs), securities depositories and systemically important payment systems. The operators themselves are separate zones on this map.

Functions

  1. Licensing market participants — exchanges and trading venues, brokers, asset managers and investment funds, CCPs and depositories; for foreign operators, recognising their home supervision as equivalent.
  2. Disclosure and investor protection — approving prospectuses for IPOs and bond issues, regular reporting by listed companies, and rules on how investment products may be sold (🇪🇺 MiFID II, 🇺🇸 the SEC, 🇩🇪 BaFin, 🇫🇷 the AMF). Sustainability disclosure belongs here too: 🇪🇺 the SFDR regulation sorts funds into those that merely account for sustainability risks, those that promote environmental or social characteristics, and those for which sustainable investment is the objective. In 2024 the three European supervisory authorities agreed a common definition of greenwashing — a sustainability claim that does not fairly reflect the real profile of a product or a company.
  3. Market integrity — monitoring trades, investigating manipulation and insider dealing, imposing fines and bans (🇪🇺 the Market Abuse Regulation, 🇺🇸 SEC Enforcement).
  4. Resilience standards for the plumbing — requirements for CCP margin and default funds, for delivery-versus-payment settlement, and for managing operational and cyber risk. The global basis is the twenty-four 🌍 CPMI–IOSCO Principles for Financial Market Infrastructures (PFMI, 2012). Oversight of payment and settlement systems sits with central banks (🇪🇺 the Eurosystem, 🇺🇸 the Federal Reserve).
  5. Recovery and resolution plans — a default waterfall written down in advance: in what order the losses from a member's default are covered — margin, default fund, the operator's own capital — and how positions are transferred if the operator itself fails.
  6. Market rules and new technology — settlement cycles (🇺🇸 T+1 since 28 May 2024, 🇪🇺 and 🇬🇧 from 11 October 2027, with the EU date written into legislation), mandatory clearing of standardised derivatives, and regimes for tokenised securities (🇪🇺 the DLT Pilot Regime) and crypto assets (🇪🇺 MiCA).

What makes it special

  • Who supervises: market regulators and central banks, usually together. 🇺🇸 The SEC (equities, securities clearing and settlement) and the CFTC (derivatives); 🇬🇧 the FCA (exchanges, brokers, asset managers) and the Bank of England (CCPs, CSDs, payment systems); 🇪🇺 ESMA plus national authorities (🇩🇪 BaFin, 🇫🇷 the AMF) plus the ECB as the central bank of issue for the euro.
  • Too important to fail — and the post-crisis architecture: a CCP becomes the buyer to every seller and the seller to every buyer, so it concentrates the risk of the whole market in one place. A bank can be wound down; a sudden failure of a CCP or a depository paralyses the entire market. That is why the risk-management requirements on infrastructure are stricter than those on banks. It is also why in 2009 the G20 decided that standardised over-the-counter derivatives should be cleared through CCPs; this was written into 🇺🇸 Dodd-Frank (2010) and 🇪🇺 EMIR (2012, updated as EMIR 3 in 2024), and for EU depositories into CSDR (2014). An older crisis gave us Herstatt risk (1974): a bank was closed after it had received one currency but before it had paid out the other.
  • The sandbox — a legal test track for the new: when a product does not fit the existing rules, the regulator can let it be tested on real customers in a regulatory sandbox. The firm gets a restricted authorisation, or individual guidance and waivers of particular rules, and sometimes a promise of no enforcement action during the test; in return the regulator sets the frame — how many customers, what sizes of transaction, how long the test runs, what has to be reported, and what happens to those customers when it ends. What a sandbox does not give: an exemption from consumer protection, or any guarantee of a full licence afterwards. 🇬🇧 The FCA opened the first one — applications for the first cohort ran from 9 May 2016. 🇸🇬 MAS issued its guidelines on 1 November 2016, and 🇯🇵 Japan's FSA has run a FinTech PoC Hub since 21 September 2017, assembling a team around each experiment to remove the legal uncertainty. 🇪🇺 The EU-level sandbox is the DLT Pilot Regime, applicable since 23 March 2023: an exchange, a depository or a combined system for tokenised securities can obtain temporary exemptions from MiFIR and CSDR, but under caps on the size of eligible issues and an overall ceiling of around six billion euros of such instruments.
  • A different logic from banking supervision, and where it borders its neighbours: the market regulator does not promise that an investor will make money — it guarantees truthful information and an equal shot, and the risk of loss stays with the investor. Exchanges, clearing houses and retail brokers as businesses live in the Exchanges & Platforms, Clearing & Settlement and Retail Access zones; this zone is only the public oversight and the rulebook. The soundness of banks, insurers and pension funds belongs to the neighbouring Regulation & Supervision zone.
  • 🇨🇳 China: an exchange is a state institution: the venues in Shanghai, Shenzhen and Beijing are not private companies but institutions under the CSRC. Since February 2023 the country has moved fully from approval-based to registration-based listing: the exchange itself checks the documents and disclosure and the CSRC registers the issue — and separately looks at whether the company fits the state's industrial policy. Formally the rules became market rules, but the last word on who gets to raise money stayed with the state.
  • 🇮🇳 India: infrastructure as a young market's advantage: the regulator SEBI pushes settlement speed harder than the old markets do. India moved to T+1 — cash and securities change hands the next business day — in three waves, finishing on 27 January 2023, a year ahead of 🇺🇸 the United States. From 28 March 2024 SEBI added an optional T+0, same-day settlement, first for a few dozen stocks and then extended in stages to hundreds of them. The lesson: a market built digitally from scratch can outrun the oldest exchanges in the world.

Why it matters

An infrastructure failure never stays local: if a CCP cannot absorb a member's default, if an exchange loses control of prices, or if a depository stops, thousands of trades hang unsettled, participants receive neither money nor securities, and trust in the market evaporates within hours.

🇮🇹 Parmalat, December 2003

Italy's largest food group collapsed on 24 December 2003 after Bank of America confirmed that an account supposedly holding nearly five billion dollars of the company's money did not exist; the hole in the accounts came to about fourteen billion euros, the biggest bankruptcy Europe had seen. Its bonds and shares had been sold to somewhere between seventy and ninety thousand ordinary Italian savers. The case is the European textbook argument for why a market regulator has to verify what a listed company discloses instead of taking its audited statements on trust.

🇯🇵 Tokyo Stock Exchange outage, 1 October 2020

A hardware fault in the Arrowhead trading system, and a failed switch to the backup, meant the Tokyo Stock Exchange never opened and traded nothing all day — the worst outage since the market went fully electronic in 1999. It turned out that even the basics had not been decided in advance: what to do with orders already placed, and how to restart trading. On 30 November 2020 the FSA issued a business improvement order to the exchange and to Japan Exchange Group, and the exchange's president resigned.

🇺🇸 Madoff and the SEC, 2008

For years Bernard Madoff paid old clients "returns" out of new clients' money — a pyramid with fictitious account statements running to tens of billions of dollars. An internal investigation found that the SEC had received six substantive complaints since 1992 and had run several examinations, yet never uncovered the scheme; it collapsed on its own in the 2008 crisis.

Links to other zones · 14

Regulation and supervision

Supervises: Clearing & settlement

Supervision is strictest here: a central counterparty or depository is not allowed to stop. They must hold margin, a default fund, a pre-agreed loss waterfall and settle delivery-versus-payment — 🌍 the CPMI-IOSCO PFMI, 🇪🇺 EMIR 3 and CSDR, 🇺🇸 the SEC and CFTC.

Standards: CPMI-IOSCO Principles for Financial Market Infrastructures (2012) · EU EMIR (648/2012) and EMIR 3 (2024/2987) · EU CSDR 909/2014 (settlement discipline, T+1 from October 2027) · EU DORA 2022/2554 · US Dodd-Frank Title VII & VIII

Supervises: Exchanges & platforms

An exchange is licensed as a trading venue and must publish prices and volumes before and after trades, monitor suspicious orders, withstand load and have a plan for outages: 🇪🇺 MiFID II/MiFIR and the Market Abuse Regulation, 🇺🇸 the SEC with Reg NMS and Reg SCI, 🇯🇵 the JFSA.

Standards: IOSCO Objectives and Principles of Securities Regulation · EU MiFID II 2014/65 / MiFIR 600/2014 (as amended by 2024/791) · EU Market Abuse Regulation 596/2014 · EU DORA 2022/2554 · US Reg NMS, Reg SCI, Exchange Act

Supervises: Retail access

A broker or investing app must act in the client's interest: check the product is suitable, seek best execution, disclose fees and keep client assets segregated. 🇪🇺 MiFIR banned payment for order flow (no exceptions after 30 June 2026); 🇺🇸 applies Reg BI and FINRA rules.

Standards: EU MiFID II 2014/65 & MiFIR 600/2014 (PFOF ban, Art 39a) · EU PRIIPs Regulation 1286/2014 · EU Investor Compensation Schemes Directive 97/9 · IOSCO Principles on retail distribution and online marketing · US Regulation Best Interest, SIPA / SIPC, FINRA rules

Supervises: Corporations & Corporate Finance

Once a company issues shares or bonds to the public it becomes supervised: the regulator approves the prospectus, reporting must be regular and truthful, and bad news must reach everyone at once (🇪🇺 the Transparency Directive and MAR, 🇺🇸 the SEC's 10-K filings).

Standards: EU Prospectus Regulation 2017/1129 and Listing Act 2024/2809 · EU Transparency Directive 2004/109 · EU Market Abuse Regulation 596/2014 · EU CSRD 2022/2464 (sustainability reporting) · US Securities Act 1933 / Exchange Act 1934; Sarbanes-Oxley

Supervises: Investment & Pension Funds

From the markets side a fund is a product seller: the prospectus and key information document must be clear, marketing must not mislead, sustainability claims must be backed up, and ETFs must quote transparently. 🇪🇺 UCITS, PRIIPs, SFDR and ESMA; 🇺🇸 the SEC.

Standards: IOSCO Objectives and Principles of Securities Regulation · EU UCITS Directive 2009/65 · EU AIFMD II 2024/927 · EU PRIIPs Regulation 1286/2014 · EU SFDR 2019/2088 and ESMA fund-naming guidelines · US Investment Company Act 1940 / Investment Advisers Act 1940

Supervises: Commodities market

Nobody regulates the sack of grain — they regulate futures on it. To stop one player cornering the market there are position limits and position reporting, plus special rules for energy: 🇪🇺 MiFID II and REMIT with the ACER agency, 🇺🇸 the CFTC.

Standards: EU MiFID II 2014/65 (position limits, position reporting) · EU REMIT (Regulation 1227/2011, as amended 2024/1106) · EU Market Abuse Regulation 596/2014 (emission allowances) · US Commodity Exchange Act; CFTC position limits (17 CFR 150) · IOSCO Principles for Oil Price Reporting Agencies

Supervises: Crypto / Digital

Crypto markets finally have conduct rules: 🇪🇺 MiCA has applied in full since 30 December 2024 — platforms need a licence, stablecoins need reserves, insider dealing and pump-and-dump are banned as on an exchange. 🇺🇸 splits oversight between SEC and CFTC; 🇯🇵 licenses exchanges.

Standards: MiCA (Regulation 2023/1114), fully applicable 30 December 2024 · IOSCO Policy Recommendations for Crypto and Digital Asset Markets (2023) · EU DLT Pilot Regime 2022/858 · US GENIUS Act 2025 (payment stablecoins) · Japan Payment Services Act / FIEA

Supervises: Debt market

Bonds mostly trade over the counter rather than on an exchange, so supervision fights for transparency: issuers register a prospectus and disclose reports, dealers report trades (🇪🇺 MiFIR and the coming consolidated tape, 🇺🇸 the TRACE system), and 🇪🇺 CSDR disciplines settlement.

Standards: IOSCO Objectives and Principles of Securities Regulation · EU Prospectus Regulation 2017/1129 · EU MiFIR 600/2014 (post-trade transparency, consolidated tape) · EU CSDR 909/2014 · US Securities Act 1933; FINRA TRACE rules; MSRB rules for municipals

Supervises: Derivatives

After 2008 the G20 pulled derivatives out of the shadows: standardised contracts go through a central counterparty, every trade is reported to a trade repository, and uncleared trades need collateral. In the 🇪🇺 that is EMIR 3, in the 🇺🇸 Dodd-Frank Title VII.

Standards: EU EMIR 648/2012 and EMIR 3 (2024/2987) · EU MiFIR 600/2014 (derivatives trading obligation) · BCBS-IOSCO margin requirements for non-centrally cleared derivatives · CPMI-IOSCO PFMI · US Dodd-Frank Title VII (CFTC and SEC swap rules)

Supervises: Stock market

The regulator promises no profit — only that everyone sees the same truth. A prospectus is approved before listing and the company reports regularly afterwards, while trading is watched for insider dealing and manipulation: 🇪🇺 MAR, 🇺🇸 the SEC, 🇯🇵 JFSA, 🇨🇳 CSRC.

Standards: IOSCO Objectives and Principles of Securities Regulation · EU Prospectus Regulation 2017/1129 (as amended by the Listing Act 2024/2809) · EU Transparency Directive 2004/109 · EU Market Abuse Regulation 596/2014 · EU Short Selling Regulation 236/2012 · US Securities Act 1933 / Exchange Act 1934

Supervises: Card networks

A card scheme is infrastructure too, so central banks check its reliability: the 🇪🇺 Eurosystem oversees card, wallet and stablecoin payment schemes under its PISA framework, a separate regulation caps interchange fees, and the 🇺🇸 Fed regulates debit routing and fees.

Standards: Eurosystem PISA oversight framework (2021) · CPMI-IOSCO PFMI (as applied to schemes) · EU Interchange Fee Regulation 2015/751 · EU DORA 2022/2554 · US Federal Reserve Regulation II (debit interchange and routing)

Supervises: Interbank systems

Systemically important payment systems are overseen by the central bank against the 🌍 CPMI-IOSCO Principles: settlement finality, surviving a member's default, cyber resilience and recovery within hours. 🇪🇺 the ECB's SIPS Regulation and DORA; 🇺🇸 the Fed's Regulation HH.

Standards: CPMI-IOSCO Principles for Financial Market Infrastructures (2012) · CPMI-IOSCO Guidance on cyber resilience for FMIs (2016) · ECB SIPS Regulation (EU) No 795/2014 · EU Settlement Finality Directive 98/26 · EU DORA 2022/2554 · US Federal Reserve Regulation HH

Supervises: Ratings & Indices

A rare case of direct supervision: 🇪🇺 ESMA itself registers rating agencies, reviews methodologies, demands disclosure of conflicts of interest and fines them; 🇺🇸 the SEC keeps the register of recognised agencies (NRSROs). Since 2008 ratings count as a systemic risk.

Standards: EU CRA Regulation 1060/2009 (as amended) · EU ESG Rating Regulation 2024/3005 · IOSCO Code of Conduct Fundamentals for Credit Rating Agencies · US Dodd-Frank Title IX Subtitle C; SEC Rule 17g

Careers in this zone · 9

Capital markets examiner (conduct supervision and enforcement)

Tracks suspicious trades on exchanges, investigates price manipulation and insider dealing, and inspects brokers and asset managers to see whether they treat clients honestly. Builds cases for sanctions or for referral to prosecutors.

What you need to know

  • Capital markets legislation (🇪🇺 MiFID II, MAR)
  • Market microstructure and trading systems
  • Common manipulation patterns
  • Enforcement procedure

Skills

  • Analysing trading data
  • Running investigations and documenting evidence
  • Writing findings clearly
  • Holding up under pressure from the other side's lawyers

Certifications: CFA, ICA; in 🇺🇸 SEC or FINRA experience is highly valued

Corporate disclosure analyst (prospectus review)

Reviews the prospectuses of companies coming to market or issuing bonds, and the regular reports of listed companies: are the risks, finances and owners disclosed fully and honestly. Can demand additions, halt an offering or trigger an investigation.

What you need to know

  • Corporate financial reporting (IFRS / US GAAP)
  • Prospectus requirements (🇪🇺 the Prospectus Regulation, 🇺🇸 the Securities Act of 1933)
  • Rules on disclosing inside information
  • Basics of valuation and capital markets

Skills

  • Reading very long documents carefully
  • Spotting gaps and contradictions in disclosure
  • Clear legal and financial writing
  • Dealing with the issuer's lawyers and underwriters

Certifications: CFA or ACCA are useful; audit or investment banking experience counts

CCP supervisor / clearing risk analyst

Checks whether a CCP holds enough margin and default fund to survive the failure of its largest members: reviews margin models, backtesting and stress test results, and the loss waterfall rules. Takes part in system-wide stress tests and in default fire drills.

What you need to know

  • Clearing mechanics and default management
  • Margin models (VaR, expected shortfall) and backtesting
  • EMIR / Dodd-Frank, the PFMI principles
  • Derivatives and liquidity risk

Skills

  • Quantitative analysis (Python, R, SQL)
  • Challenging someone else's model
  • Thinking in what-if scenarios
  • Writing supervisory findings

Certifications: FRM, CQF are useful

Payment systems oversight specialist (central bank)

Assesses payment systems, card schemes and critical service providers against the PFMI standards: operational resilience, backup sites, settlement rules, participant risk. Responds to outages and requires the gaps to be closed.

What you need to know

  • Payment and settlement system architecture
  • The PFMI principles and national payment services law
  • Operational risk and business continuity
  • Card and instant payments

Skills

  • Running assessments and inspections
  • Incident analysis
  • Working with operators and banks
  • Structured report writing

Certifications: Usually not required — central bank and BIS courses are useful

Post-trade and depository supervisor

Oversees central securities depositories and settlement systems: the accuracy of securities ownership records, settlement on time, penalties for settlement fails, preparation for the move to T+1. Works through incidents and reconciliation breaks.

What you need to know

  • Securities accounting, nominee holding, custody
  • Settlement cycles and delivery versus payment
  • 🇪🇺 CSDR, 🇺🇸 the SEC's clearing agency rules
  • Corporate actions and entitlement processing

Skills

  • Analysing settlement data
  • Reviewing processes and controls
  • Attention to detail
  • Working with the market on rule changes

Certifications: Usually not required

Exchange and trading venue supervisor

Reviews trading rules, circuit breakers and volatility controls, participant access and price transparency. After an outage, assesses whether the exchange's own controls actually worked.

What you need to know

  • Market microstructure and types of trading system
  • 🇪🇺 MiFID II / MiFIR for trading venues
  • Volatility controls and algorithmic trading
  • Commodity and financial derivatives

Skills

  • Analysing high-frequency trading data
  • Working through incidents
  • Writing findings and directions
  • Dialogue with exchange operators

Certifications: Usually not required — experience at an exchange or broker counts

Cyber resilience and IT risk specialist for infrastructure

Assesses whether the infrastructure would survive a cyber attack or a supplier failure: recovery plans, backup sites, cloud dependencies, penetration test results.

What you need to know

  • Operational resilience regulation (🇪🇺 DORA, CPMI–IOSCO cyber resilience guidance)
  • Cybersecurity and IT risk management
  • Business continuity
  • Third-party and cloud risk

Skills

  • Auditing IT systems and controls
  • Incident analysis
  • Translating technical risk into board language
  • Running scenario exercises

Certifications: CISA, CISSP, CISM

Infrastructure policy and standards specialist

Drafts new rules and the regulator's positions, from revising margin standards to regimes for tokenised securities. Represents the country or the authority in international working groups (🌍 CPMI, IOSCO, the FSB; 🇪🇺 ESMA).

What you need to know

  • The PFMI principles and the international regulatory agenda
  • EMIR, CSDR, the DLT Pilot Regime
  • Tokenisation and distributed ledgers
  • Comparative regulation across jurisdictions

Skills

  • Legally precise drafting
  • Regulatory impact analysis
  • Negotiating in international groups
  • English at working-document level

Certifications: Usually not required

Risk or regulatory affairs manager at an infrastructure operator (the mirror role in the private sector)

The same work from the other side of the table: at a CCP, depository or exchange (the Clearing & Settlement zone) building margin models, running stress tests, preparing reporting and answers to the regulator. The role follows directly from this zone: the rules supervisors write are executed daily by teams like this, and people move constantly between the two.

What you need to know

  • CCP risk management and default handling
  • Regulatory requirements for infrastructure
  • Derivatives and collateral
  • Operational risk

Skills

  • Quantitative modelling
  • Preparing material for the regulator
  • Crisis procedures
  • Working with participant clients

Certifications: FRM, CFA

All zones of the Atlas