REGULATION & SUPERVISION
Financial Market Infrastructure
Watches that trading stays honest and the market's plumbing does not break.
This page is the text version of one zone of the interactive map.
Its role in the system
Makes sure capital markets are fair, transparent and unbreakable. The market regulator licenses exchanges, brokers and asset managers, forces companies to tell investors the truth, investigates manipulation and insider dealing, and — together with the central bank — oversees the market's plumbing: central counterparties (CCPs), securities depositories and systemically important payment systems. The operators themselves are separate zones on this map.
Functions
- Licensing market participants — exchanges and trading venues, brokers, asset managers and investment funds, CCPs and depositories; for foreign operators, recognising their home supervision as equivalent.
- Disclosure and investor protection — approving prospectuses for IPOs and bond issues, regular reporting by listed companies, and rules on how investment products may be sold (🇪🇺 MiFID II, 🇺🇸 the SEC, 🇩🇪 BaFin, 🇫🇷 the AMF). Sustainability disclosure belongs here too: 🇪🇺 the SFDR regulation sorts funds into those that merely account for sustainability risks, those that promote environmental or social characteristics, and those for which sustainable investment is the objective. In 2024 the three European supervisory authorities agreed a common definition of greenwashing — a sustainability claim that does not fairly reflect the real profile of a product or a company.
- Market integrity — monitoring trades, investigating manipulation and insider dealing, imposing fines and bans (🇪🇺 the Market Abuse Regulation, 🇺🇸 SEC Enforcement).
- Resilience standards for the plumbing — requirements for CCP margin and default funds, for delivery-versus-payment settlement, and for managing operational and cyber risk. The global basis is the twenty-four 🌍 CPMI–IOSCO Principles for Financial Market Infrastructures (PFMI, 2012). Oversight of payment and settlement systems sits with central banks (🇪🇺 the Eurosystem, 🇺🇸 the Federal Reserve).
- Recovery and resolution plans — a default waterfall written down in advance: in what order the losses from a member's default are covered — margin, default fund, the operator's own capital — and how positions are transferred if the operator itself fails.
- Market rules and new technology — settlement cycles (🇺🇸 T+1 since 28 May 2024, 🇪🇺 and 🇬🇧 from 11 October 2027, with the EU date written into legislation), mandatory clearing of standardised derivatives, and regimes for tokenised securities (🇪🇺 the DLT Pilot Regime) and crypto assets (🇪🇺 MiCA).
What makes it special
- Who supervises: market regulators and central banks, usually together. 🇺🇸 The SEC (equities, securities clearing and settlement) and the CFTC (derivatives); 🇬🇧 the FCA (exchanges, brokers, asset managers) and the Bank of England (CCPs, CSDs, payment systems); 🇪🇺 ESMA plus national authorities (🇩🇪 BaFin, 🇫🇷 the AMF) plus the ECB as the central bank of issue for the euro.
- Too important to fail — and the post-crisis architecture: a CCP becomes the buyer to every seller and the seller to every buyer, so it concentrates the risk of the whole market in one place. A bank can be wound down; a sudden failure of a CCP or a depository paralyses the entire market. That is why the risk-management requirements on infrastructure are stricter than those on banks. It is also why in 2009 the G20 decided that standardised over-the-counter derivatives should be cleared through CCPs; this was written into 🇺🇸 Dodd-Frank (2010) and 🇪🇺 EMIR (2012, updated as EMIR 3 in 2024), and for EU depositories into CSDR (2014). An older crisis gave us Herstatt risk (1974): a bank was closed after it had received one currency but before it had paid out the other.
- The sandbox — a legal test track for the new: when a product does not fit the existing rules, the regulator can let it be tested on real customers in a regulatory sandbox. The firm gets a restricted authorisation, or individual guidance and waivers of particular rules, and sometimes a promise of no enforcement action during the test; in return the regulator sets the frame — how many customers, what sizes of transaction, how long the test runs, what has to be reported, and what happens to those customers when it ends. What a sandbox does not give: an exemption from consumer protection, or any guarantee of a full licence afterwards. 🇬🇧 The FCA opened the first one — applications for the first cohort ran from 9 May 2016. 🇸🇬 MAS issued its guidelines on 1 November 2016, and 🇯🇵 Japan's FSA has run a FinTech PoC Hub since 21 September 2017, assembling a team around each experiment to remove the legal uncertainty. 🇪🇺 The EU-level sandbox is the DLT Pilot Regime, applicable since 23 March 2023: an exchange, a depository or a combined system for tokenised securities can obtain temporary exemptions from MiFIR and CSDR, but under caps on the size of eligible issues and an overall ceiling of around six billion euros of such instruments.
- A different logic from banking supervision, and where it borders its neighbours: the market regulator does not promise that an investor will make money — it guarantees truthful information and an equal shot, and the risk of loss stays with the investor. Exchanges, clearing houses and retail brokers as businesses live in the Exchanges & Platforms, Clearing & Settlement and Retail Access zones; this zone is only the public oversight and the rulebook. The soundness of banks, insurers and pension funds belongs to the neighbouring Regulation & Supervision zone.
- 🇨🇳 China: an exchange is a state institution: the venues in Shanghai, Shenzhen and Beijing are not private companies but institutions under the CSRC. Since February 2023 the country has moved fully from approval-based to registration-based listing: the exchange itself checks the documents and disclosure and the CSRC registers the issue — and separately looks at whether the company fits the state's industrial policy. Formally the rules became market rules, but the last word on who gets to raise money stayed with the state.
- 🇮🇳 India: infrastructure as a young market's advantage: the regulator SEBI pushes settlement speed harder than the old markets do. India moved to T+1 — cash and securities change hands the next business day — in three waves, finishing on 27 January 2023, a year ahead of 🇺🇸 the United States. From 28 March 2024 SEBI added an optional T+0, same-day settlement, first for a few dozen stocks and then extended in stages to hundreds of them. The lesson: a market built digitally from scratch can outrun the oldest exchanges in the world.
Why it matters
An infrastructure failure never stays local: if a CCP cannot absorb a member's default, if an exchange loses control of prices, or if a depository stops, thousands of trades hang unsettled, participants receive neither money nor securities, and trust in the market evaporates within hours.
Italy's largest food group collapsed on 24 December 2003 after Bank of America confirmed that an account supposedly holding nearly five billion dollars of the company's money did not exist; the hole in the accounts came to about fourteen billion euros, the biggest bankruptcy Europe had seen. Its bonds and shares had been sold to somewhere between seventy and ninety thousand ordinary Italian savers. The case is the European textbook argument for why a market regulator has to verify what a listed company discloses instead of taking its audited statements on trust.
A hardware fault in the Arrowhead trading system, and a failed switch to the backup, meant the Tokyo Stock Exchange never opened and traded nothing all day — the worst outage since the market went fully electronic in 1999. It turned out that even the basics had not been decided in advance: what to do with orders already placed, and how to restart trading. On 30 November 2020 the FSA issued a business improvement order to the exchange and to Japan Exchange Group, and the exchange's president resigned.
For years Bernard Madoff paid old clients "returns" out of new clients' money — a pyramid with fictitious account statements running to tens of billions of dollars. An internal investigation found that the SEC had received six substantive complaints since 1992 and had run several examinations, yet never uncovered the scheme; it collapsed on its own in the 2008 crisis.
Links to other zones · 14
- Clearing & settlementClearing & settlement is the main supervised sector for Financial Market Infrastructure: central counterparties, depositories and settlement systems work under licence and to the PFMI standards.
- Corporations & Corporate FinanceCorporations & Corporate Finance are not supervised firms, yet as issuers they are the main addressee of Financial Market Infrastructure: without an approved prospectus there is no IPO and no bond issue.
- Crypto / DigitalFinancial Market Infrastructure licenses crypto service providers and sets requirements for the token issuers of Crypto / Digital (🇪🇺 MiCA, 🇺🇸 SEC and CFTC).
- Debt marketFinancial Market Infrastructure approves bond prospectuses, polices issuer disclosure and is steadily pulling the Debt market into central clearing and shorter settlement cycles.
- DerivativesMandatory clearing of standardised Derivatives and trade reporting to repositories is a direct consequence of the 2008 crisis, enforced by Financial Market Infrastructure (🇺🇸 CFTC, 🇪🇺 ESMA).
- Exchanges & platformsFinancial Market Infrastructure licenses Exchanges & platforms and sets the requirements for trading rules, circuit breakers and trade surveillance.
- Financial Media & DataDisclosure rules from Financial Market Infrastructure decide when and how an issuer releases news so that the market learns it at the same moment, and spreading false rumours through Financial Media & Data counts as manipulation.
- Interbank systemsFinancial Market Infrastructure oversees systemically important Interbank systems against the PFMI principles, and the central bank often operates them itself (🇪🇺 T2).
- Investment & Pension FundsFinancial Market Infrastructure licenses the managers of Investment & Pension Funds and writes the fund rulebook (🇪🇺 UCITS, AIFMD; 🇺🇸 SEC).
- Ratings & IndicesRating agencies and benchmark administrators in Ratings & Indices operate on registration and under the direct eye of Financial Market Infrastructure (🇺🇸 SEC, 🇪🇺 ESMA) — precisely because everyone else's rules lean on their scores.
- Regulation & SupervisionThe two supervisory zones split the work: Regulation & Supervision answers for the soundness of banks, insurers and pension funds, Financial Market Infrastructure for fair trading and resilient clearing houses and depositories. Banks that clear answer to both.
- Retail accessRetail access works under Financial Market Infrastructure: broker licensing, product suitability rules, and schemes that repay investors when a broker goes bankrupt.
- Stock marketFinancial Market Infrastructure approves prospectuses, polices disclosure by listed companies and punishes manipulation and insider dealing in the Stock market.
- Technology & InfrastructureThe Technology zone is what this supervisor both licenses and road-tests: trading and depository systems, algorithmic trading, tokenised securities, and the critical IT and cloud providers behind exchanges and CCPs (🇪🇺 DORA extends operational-resilience requirements to them). For whatever is not yet regulated there is a legal test track — the regulatory sandbox and 🇪🇺 the DLT Pilot Regime: a limited test on real customers under caps, reporting duties and an exit plan. Supervisors are themselves moving to machine analytics of trading data to catch manipulation.
Regulation and supervision
Supervision is strictest here: a central counterparty or depository is not allowed to stop. They must hold margin, a default fund, a pre-agreed loss waterfall and settle delivery-versus-payment — 🌍 the CPMI-IOSCO PFMI, 🇪🇺 EMIR 3 and CSDR, 🇺🇸 the SEC and CFTC.
Standards: CPMI-IOSCO Principles for Financial Market Infrastructures (2012) · EU EMIR (648/2012) and EMIR 3 (2024/2987) · EU CSDR 909/2014 (settlement discipline, T+1 from October 2027) · EU DORA 2022/2554 · US Dodd-Frank Title VII & VIII
An exchange is licensed as a trading venue and must publish prices and volumes before and after trades, monitor suspicious orders, withstand load and have a plan for outages: 🇪🇺 MiFID II/MiFIR and the Market Abuse Regulation, 🇺🇸 the SEC with Reg NMS and Reg SCI, 🇯🇵 the JFSA.
Standards: IOSCO Objectives and Principles of Securities Regulation · EU MiFID II 2014/65 / MiFIR 600/2014 (as amended by 2024/791) · EU Market Abuse Regulation 596/2014 · EU DORA 2022/2554 · US Reg NMS, Reg SCI, Exchange Act
A broker or investing app must act in the client's interest: check the product is suitable, seek best execution, disclose fees and keep client assets segregated. 🇪🇺 MiFIR banned payment for order flow (no exceptions after 30 June 2026); 🇺🇸 applies Reg BI and FINRA rules.
Standards: EU MiFID II 2014/65 & MiFIR 600/2014 (PFOF ban, Art 39a) · EU PRIIPs Regulation 1286/2014 · EU Investor Compensation Schemes Directive 97/9 · IOSCO Principles on retail distribution and online marketing · US Regulation Best Interest, SIPA / SIPC, FINRA rules
Once a company issues shares or bonds to the public it becomes supervised: the regulator approves the prospectus, reporting must be regular and truthful, and bad news must reach everyone at once (🇪🇺 the Transparency Directive and MAR, 🇺🇸 the SEC's 10-K filings).
Standards: EU Prospectus Regulation 2017/1129 and Listing Act 2024/2809 · EU Transparency Directive 2004/109 · EU Market Abuse Regulation 596/2014 · EU CSRD 2022/2464 (sustainability reporting) · US Securities Act 1933 / Exchange Act 1934; Sarbanes-Oxley
From the markets side a fund is a product seller: the prospectus and key information document must be clear, marketing must not mislead, sustainability claims must be backed up, and ETFs must quote transparently. 🇪🇺 UCITS, PRIIPs, SFDR and ESMA; 🇺🇸 the SEC.
Standards: IOSCO Objectives and Principles of Securities Regulation · EU UCITS Directive 2009/65 · EU AIFMD II 2024/927 · EU PRIIPs Regulation 1286/2014 · EU SFDR 2019/2088 and ESMA fund-naming guidelines · US Investment Company Act 1940 / Investment Advisers Act 1940
Nobody regulates the sack of grain — they regulate futures on it. To stop one player cornering the market there are position limits and position reporting, plus special rules for energy: 🇪🇺 MiFID II and REMIT with the ACER agency, 🇺🇸 the CFTC.
Standards: EU MiFID II 2014/65 (position limits, position reporting) · EU REMIT (Regulation 1227/2011, as amended 2024/1106) · EU Market Abuse Regulation 596/2014 (emission allowances) · US Commodity Exchange Act; CFTC position limits (17 CFR 150) · IOSCO Principles for Oil Price Reporting Agencies
Crypto markets finally have conduct rules: 🇪🇺 MiCA has applied in full since 30 December 2024 — platforms need a licence, stablecoins need reserves, insider dealing and pump-and-dump are banned as on an exchange. 🇺🇸 splits oversight between SEC and CFTC; 🇯🇵 licenses exchanges.
Standards: MiCA (Regulation 2023/1114), fully applicable 30 December 2024 · IOSCO Policy Recommendations for Crypto and Digital Asset Markets (2023) · EU DLT Pilot Regime 2022/858 · US GENIUS Act 2025 (payment stablecoins) · Japan Payment Services Act / FIEA
Bonds mostly trade over the counter rather than on an exchange, so supervision fights for transparency: issuers register a prospectus and disclose reports, dealers report trades (🇪🇺 MiFIR and the coming consolidated tape, 🇺🇸 the TRACE system), and 🇪🇺 CSDR disciplines settlement.
Standards: IOSCO Objectives and Principles of Securities Regulation · EU Prospectus Regulation 2017/1129 · EU MiFIR 600/2014 (post-trade transparency, consolidated tape) · EU CSDR 909/2014 · US Securities Act 1933; FINRA TRACE rules; MSRB rules for municipals
After 2008 the G20 pulled derivatives out of the shadows: standardised contracts go through a central counterparty, every trade is reported to a trade repository, and uncleared trades need collateral. In the 🇪🇺 that is EMIR 3, in the 🇺🇸 Dodd-Frank Title VII.
Standards: EU EMIR 648/2012 and EMIR 3 (2024/2987) · EU MiFIR 600/2014 (derivatives trading obligation) · BCBS-IOSCO margin requirements for non-centrally cleared derivatives · CPMI-IOSCO PFMI · US Dodd-Frank Title VII (CFTC and SEC swap rules)
The regulator promises no profit — only that everyone sees the same truth. A prospectus is approved before listing and the company reports regularly afterwards, while trading is watched for insider dealing and manipulation: 🇪🇺 MAR, 🇺🇸 the SEC, 🇯🇵 JFSA, 🇨🇳 CSRC.
Standards: IOSCO Objectives and Principles of Securities Regulation · EU Prospectus Regulation 2017/1129 (as amended by the Listing Act 2024/2809) · EU Transparency Directive 2004/109 · EU Market Abuse Regulation 596/2014 · EU Short Selling Regulation 236/2012 · US Securities Act 1933 / Exchange Act 1934
A card scheme is infrastructure too, so central banks check its reliability: the 🇪🇺 Eurosystem oversees card, wallet and stablecoin payment schemes under its PISA framework, a separate regulation caps interchange fees, and the 🇺🇸 Fed regulates debit routing and fees.
Standards: Eurosystem PISA oversight framework (2021) · CPMI-IOSCO PFMI (as applied to schemes) · EU Interchange Fee Regulation 2015/751 · EU DORA 2022/2554 · US Federal Reserve Regulation II (debit interchange and routing)
Systemically important payment systems are overseen by the central bank against the 🌍 CPMI-IOSCO Principles: settlement finality, surviving a member's default, cyber resilience and recovery within hours. 🇪🇺 the ECB's SIPS Regulation and DORA; 🇺🇸 the Fed's Regulation HH.
Standards: CPMI-IOSCO Principles for Financial Market Infrastructures (2012) · CPMI-IOSCO Guidance on cyber resilience for FMIs (2016) · ECB SIPS Regulation (EU) No 795/2014 · EU Settlement Finality Directive 98/26 · EU DORA 2022/2554 · US Federal Reserve Regulation HH
A rare case of direct supervision: 🇪🇺 ESMA itself registers rating agencies, reviews methodologies, demands disclosure of conflicts of interest and fines them; 🇺🇸 the SEC keeps the register of recognised agencies (NRSROs). Since 2008 ratings count as a systemic risk.
Standards: EU CRA Regulation 1060/2009 (as amended) · EU ESG Rating Regulation 2024/3005 · IOSCO Code of Conduct Fundamentals for Credit Rating Agencies · US Dodd-Frank Title IX Subtitle C; SEC Rule 17g
Careers in this zone · 9
Capital markets examiner (conduct supervision and enforcement)
Tracks suspicious trades on exchanges, investigates price manipulation and insider dealing, and inspects brokers and asset managers to see whether they treat clients honestly. Builds cases for sanctions or for referral to prosecutors.
What you need to know
- Capital markets legislation (🇪🇺 MiFID II, MAR)
- Market microstructure and trading systems
- Common manipulation patterns
- Enforcement procedure
Skills
- Analysing trading data
- Running investigations and documenting evidence
- Writing findings clearly
- Holding up under pressure from the other side's lawyers
Certifications: CFA, ICA; in 🇺🇸 SEC or FINRA experience is highly valued
Corporate disclosure analyst (prospectus review)
Reviews the prospectuses of companies coming to market or issuing bonds, and the regular reports of listed companies: are the risks, finances and owners disclosed fully and honestly. Can demand additions, halt an offering or trigger an investigation.
What you need to know
- Corporate financial reporting (IFRS / US GAAP)
- Prospectus requirements (🇪🇺 the Prospectus Regulation, 🇺🇸 the Securities Act of 1933)
- Rules on disclosing inside information
- Basics of valuation and capital markets
Skills
- Reading very long documents carefully
- Spotting gaps and contradictions in disclosure
- Clear legal and financial writing
- Dealing with the issuer's lawyers and underwriters
Certifications: CFA or ACCA are useful; audit or investment banking experience counts
CCP supervisor / clearing risk analyst
Checks whether a CCP holds enough margin and default fund to survive the failure of its largest members: reviews margin models, backtesting and stress test results, and the loss waterfall rules. Takes part in system-wide stress tests and in default fire drills.
What you need to know
- Clearing mechanics and default management
- Margin models (VaR, expected shortfall) and backtesting
- EMIR / Dodd-Frank, the PFMI principles
- Derivatives and liquidity risk
Skills
- Quantitative analysis (Python, R, SQL)
- Challenging someone else's model
- Thinking in what-if scenarios
- Writing supervisory findings
Certifications: FRM, CQF are useful
Payment systems oversight specialist (central bank)
Assesses payment systems, card schemes and critical service providers against the PFMI standards: operational resilience, backup sites, settlement rules, participant risk. Responds to outages and requires the gaps to be closed.
What you need to know
- Payment and settlement system architecture
- The PFMI principles and national payment services law
- Operational risk and business continuity
- Card and instant payments
Skills
- Running assessments and inspections
- Incident analysis
- Working with operators and banks
- Structured report writing
Certifications: Usually not required — central bank and BIS courses are useful
Post-trade and depository supervisor
Oversees central securities depositories and settlement systems: the accuracy of securities ownership records, settlement on time, penalties for settlement fails, preparation for the move to T+1. Works through incidents and reconciliation breaks.
What you need to know
- Securities accounting, nominee holding, custody
- Settlement cycles and delivery versus payment
- 🇪🇺 CSDR, 🇺🇸 the SEC's clearing agency rules
- Corporate actions and entitlement processing
Skills
- Analysing settlement data
- Reviewing processes and controls
- Attention to detail
- Working with the market on rule changes
Certifications: Usually not required
Exchange and trading venue supervisor
Reviews trading rules, circuit breakers and volatility controls, participant access and price transparency. After an outage, assesses whether the exchange's own controls actually worked.
What you need to know
- Market microstructure and types of trading system
- 🇪🇺 MiFID II / MiFIR for trading venues
- Volatility controls and algorithmic trading
- Commodity and financial derivatives
Skills
- Analysing high-frequency trading data
- Working through incidents
- Writing findings and directions
- Dialogue with exchange operators
Certifications: Usually not required — experience at an exchange or broker counts
Cyber resilience and IT risk specialist for infrastructure
Assesses whether the infrastructure would survive a cyber attack or a supplier failure: recovery plans, backup sites, cloud dependencies, penetration test results.
What you need to know
- Operational resilience regulation (🇪🇺 DORA, CPMI–IOSCO cyber resilience guidance)
- Cybersecurity and IT risk management
- Business continuity
- Third-party and cloud risk
Skills
- Auditing IT systems and controls
- Incident analysis
- Translating technical risk into board language
- Running scenario exercises
Certifications: CISA, CISSP, CISM
Infrastructure policy and standards specialist
Drafts new rules and the regulator's positions, from revising margin standards to regimes for tokenised securities. Represents the country or the authority in international working groups (🌍 CPMI, IOSCO, the FSB; 🇪🇺 ESMA).
What you need to know
- The PFMI principles and the international regulatory agenda
- EMIR, CSDR, the DLT Pilot Regime
- Tokenisation and distributed ledgers
- Comparative regulation across jurisdictions
Skills
- Legally precise drafting
- Regulatory impact analysis
- Negotiating in international groups
- English at working-document level
Certifications: Usually not required
Risk or regulatory affairs manager at an infrastructure operator (the mirror role in the private sector)
The same work from the other side of the table: at a CCP, depository or exchange (the Clearing & Settlement zone) building margin models, running stress tests, preparing reporting and answers to the regulator. The role follows directly from this zone: the rules supervisors write are executed daily by teams like this, and people move constantly between the two.
What you need to know
- CCP risk management and default handling
- Regulatory requirements for infrastructure
- Derivatives and collateral
- Operational risk
Skills
- Quantitative modelling
- Preparing material for the regulator
- Crisis procedures
- Working with participant clients
Certifications: FRM, CFA
All zones of the Atlas
- Clearing & settlement
- Exchanges & platforms
- Retail access
- Banking & Credit Institutions
- Corporations & Corporate Finance
- Development Banks
- Investment & Pension Funds
- Anti-Money Laundering
- Fiscal Policy
- Monetary Policy
- Regulation & Supervision
- Households & Individuals
- Insurance
- Commodities market
- Crypto / Digital
- Debt market
- Derivatives
- Stock market
- FX market
- Real estate market
- Card networks
- Crypto / CBDC
- Digital payments
- Interbank systems
- International transfers
- Sovereign Wealth Funds
- State Insurance & Guarantees
- Audit & Assurance
- Consulting & Advisory
- Credit Information
- Education & Certification
- Financial Media & Data
- Ratings & Indices
- Technology & Infrastructure