Implement governance + organisational + compliance + outsourcing requirements under MiFID II Articles 8-13 + Article 16 + Article 22. Management body composition (Article 9) - sufficient time + collective knowledge skills experience + commitment + diversity policy + nomination committee for significant firms. Fit and proper requirements (Article 9(1) + Articles 10-12). Organisational requirements (Article 16) including risk management framework + segregation of duties + IT systems + business continuity + record keeping (Article 16(6)-(7) including telephone recording 5-year minimum 7-year on NCA request) + safeguarding client funds and assets (Article 16(8)-(9) + Title II Commission Delegated Directive 2017/593). Outsourcing (Article 16(5) + Commission Delegated Regulation 2017/565 Articles 30-32) covering critical or important operational functions + due diligence + written agreement + ongoing oversight + business continuity + NCA notification + cloud outsourcing under ESMA Guidelines 2021. Compliance function (Article 22 + Commission Delegated Regulation 2017/565 Article 22) independent + sufficient authority + reports to management body + annual compliance report. Internal audit + risk management as 2nd and 3rd lines of defence. Whistleblowing Article 73 reporting infringements. Diversity governance ESMA Guidelines 2022.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.