Control template: MiFID II / MiFIR (transaction reporting + record-keeping)

Status: Stable · Version: mifid-ii/v1.0.0

A bundle of CALM control snippets covering the architecturally enforceable subset of MiFID II (Directive 2014/65/EU) and MiFIR (Regulation (EU) 600/2014), with emphasis on RTS 22 (transaction reporting), RTS 25 (clock synchronisation), and the record-keeping obligations under Art. 16 + Art. 25. You copy these into your *.calm.json files on the nodes that execute, route, record, or report investment-service activity.

Who MiFID II applies to

EU and UK investment firms (and their subsidiaries / branches) providing investment services or performing investment activities under MiFID II Annex I. Common categories: - Banks operating an investment-services division - Independent investment firms (brokers, dealers, asset managers) - Trading venues (RM, MTF, OTF) and their operators - Systematic Internalisers (SI) - Approved Reporting Mechanisms (ARMs) and Approved Publication Arrangements (APAs)

Brexit note: UK firms operate under the UK's onshored regime (UK MiFIR + the FCA's Handbook), substantively aligned with EU MiFID II at the time of writing but increasingly divergent. This template uses the EU naming conventions; the architectural surface is substantially the same under UK rules. Confirm specifics with your compliance team.

What this template covers

3 controls covering the architecturally enforceable subset. Algorithmic trading (Art. 17 / RTS 6), pre/post-trade transparency (RTS 1 / RTS 2), and SI quoting (RTS 1) are NOT in this template — they're specialised regimes; sub-templates may follow.

The "MiFID-scope" pattern

A node is MiFID-scope if it executes, routes, records, or reports investment-service activity (trades, orders, quotes, decisions to deal). Tag those nodes:

{
  "unique-id": "execution-router",
  "node-type": "service",
  "name": "Execution Router",
  "metadata": {
    "mifid-in-scope": true,
    "mifid-activity": "execution-on-own-account",
    "data-classification": "regulated-financial"
  }
}

Then attach the relevant controls below.

Control snippets

Copy each block under the controls key of the node it applies to.

Directive Art. 16(7) — Trade-record retention (mifid-trade-record-retention)

Per-node. Minimum five years; some NCAs require seven for specific activity (e.g., investment advice). Tune to your firm's record-retention policy.

"mifid-trade-record-retention": {
  "description": "MiFID II Directive Art. 16(7) — trade records retained for at least 5 years (some NCAs require 7).",
  "requirements": [
    {
      "requirement-url": "https://archrails.io/catalog/req/mifid/trade-record-retention",
      "config": {
        "control-id": "mifid-trade-record-retention",
        "retention-days": 1827,
        "storage-immutable": true,
        "storage-location": "s3-with-object-lock",
        "required-fields": ["transaction_reference_number", "client_id", "trade_date"]
      }
    }
  ]
}

Directive Art. 16(6) — Order record-keeping (mifid-order-record-keeping)

Per-node. Pre-trade order data (placed, amended, cancelled) plus execution details.

"mifid-order-record-keeping": {
  "description": "MiFID II Directive Art. 16(6) — record of all services, activities, and transactions sufficient to allow the competent authority to reconstruct each key stage.",
  "requirements": [
    {
      "requirement-url": "https://archrails.io/catalog/req/mifid/order-record-keeping",
      "config": {
        "control-id": "mifid-order-record-keeping",
        "required-fields": ["order-placed", "order-amended", "order-cancelled", "order-rejected", "order-routed", "execution-received"],
        "retention-days": 1827,
        "destination": "centralized-immutable-store"
      }
    }
  ]
}

Directive Art. 16(11) + Delegated Reg. Art. 76(11) — Electronic-communication recording (mifid-electronic-communication-recording)

Per-node. Recording of telephone and electronic communications relating to transactions.

"mifid-electronic-communication-recording": {
  "description": "MiFID II Directive Art. 16(11) + Delegated Reg. (EU) 2017/565 Art. 76(11) — recording of phone calls and electronic communications relating to transactions intended to result in a deal. Retained at least 5 years (7 for some activities or where the NCA requires).",
  "requirements": [
    {
      "requirement-url": "https://archrails.io/catalog/req/mifid/electronic-communication-recording",
      "config": {
        "control-id": "mifid-electronic-communication-recording",
        "required-fields": ["voice", "email", "chat", "instant-messaging"],
        "retention-days": 1827,
        "storage-immutable": true,
        "client-notification-required": true
      }
    }
  ]
}

What the engine actually enforces

There is no MiFID-specific cross-cutter — the engine has no "if mifid-in-scope: true, require these 10 controls" sweep. Enforcement is graph-driven: you attach a control where you want it enforced; the absence of an attach is opt-out by silence.

For the 3 MiFID II controls above, here is the honest split:

Enforced via attestation (constraint engine)

Every snippet's config block is read by the constraint engine: presence / exact / enum / set_required / set_forbidden shapes are inferred from what you authored, and the agent's declared_pattern must satisfy them. This applies to retention days, required captured order events, and required channel coverage.

Enforced via sensitivity-gated validators (separate path)

When a node declares data-classification: regulated-financial / confidential / restricted / pii / pci, a set of always-on architectural validators fires on changes to that node's code — independent of which MiFID controls you've authored. These cover:

• Secret detection — substantive enforcement against credentials inadvertently committed near trade-data code paths
• Weak crypto — deprecated algorithms on regulated-financial nodes
• Authorization — sensitive nodes must have an authz layer
• Edge protocol — plaintext protocols on edges touching regulated-financial nodes
• Sensitive fixture detection — real-looking LEI / CONCAT / ISIN literals committed to governed files
• Retention — required retention windows on regulated-financial data stores (substantive enforcement for the Art. 16(6)/(7)/(11) record-keeping intents).

And the diff-walking AR-REL-008 validator fires on any outbound call from a MiFID-scope node to an external host that the node's allowed_connects doesn't declare.

All checks are deterministic — pure function over your CALM JSON. Verdicts are replayable byte-for-byte. The same constraint engine handles PCI DSS, GDPR, SOC 2, HIPAA, NIST CSF 2, ISO 27001:2022, NYDFS Part 500, and any controls you author yourself.

Versioning

This is mifid-ii/v1.0.0 — the first stable cut. Each surviving control has per-validator firing tests + cross-language coverage across 11 Tier A languages (Python, Java, C#, TypeScript, Go, Kotlin, Scala, Rust, Ruby, Swift, PHP). Future bumps: v1.x.y for additive controls and substantive validator coverage; v2.0.0 for breaking changes (control retired, semantics changed). Updates as authoritative guidance or enforcement priorities materially shift.

Out of scope for this template

• Algorithmic trading controls (Directive Art. 17 / RTS 6) — specialised regime for algorithmic and HFT firms; pre-trade controls, kill switches, market making, capacity testing. Sub- template may follow if customers ask.
• Pre/post-trade transparency (MiFIR Art. 3+10 / RTS 1 / RTS 2) — trading venues, SIs, and APAs. Sub-template may follow.
• Product governance (Directive Art. 16(3) + Art. 24(2)) — target market definition, ongoing review. Mostly process / governance, not architectural.
• Conduct of business / suitability (Directive Art. 25) — client onboarding, KYC, suitability assessments. Process / procedural, not architectural.
• Market-abuse surveillance (MAR, separate from MiFID II) — there's a separate framework (Market Abuse Regulation, EU 596/2014) with its own architectural surface.

For those surfaces, pair this template with your MiFID II compliance framework and engage an FCA / CySEC / NCA-experienced compliance consultant.