The WpIG Framework: Navigating Securities Institution Regulation in Germany

The Wertpapierinstitutsgesetz (WpIG — Securities Institutions Act), which entered into force on June 26, 2021, fundamentally restructured the regulatory framework for investment firms in Germany. By transposing the EU's Investment Firm Directive (IFD, Directive (EU) 2019/2034) and complementing the directly applicable Investment Firm Regulation (IFR, Regulation (EU) 2019/2033), the WpIG created a dedicated supervisory regime for securities institutions that is distinct from the banking supervision framework under the Kreditwesengesetz (KWG).

For fintech companies providing investment services — including neo-brokers, robo-advisors, tokenised securities venues, and digital wealth management providers — the WpIG defines the regulatory environment in which they must operate. Understanding its structure, classification system, capital requirements, governance obligations, and application process is essential for both licensing strategy and ongoing compliance. This guide provides a detailed walk-through of the framework, with particular attention to the practical implications for growth-stage fintech companies considering or currently pursuing a WpIG authorisation.

Historical Context

Before June 26, 2021, investment firms in Germany were regulated primarily under the Kreditwesengesetz (KWG), the same statute that governs banks and other credit institutions. This approach had the advantage of conceptual simplicity but the significant disadvantage that investment firms — whose risks differ materially from those of deposit-taking banks — were subject to a capital framework designed for banks. The Capital Requirements Regulation (CRR) and the Capital Requirements Directive IV (CRD IV) imposed capital calculations based on credit, market, and operational risk concepts that frequently overcapitalised investment firms relative to the actual risks they ran.

The problem was widely recognised at the European level. Investment firms that do not take deposits, do not run significant credit books, and do not act as the systemic plumbing of the financial system do not present the same risk profile as banks. Holding them to a bank-style capital framework imposed compliance costs that were disproportionate to the prudential benefits, distorted competition between EU member states with different interpretations of the rules, and created entry barriers for innovative business models that did not fit neatly into banking categories.

The EU's 2019 prudential reform for investment firms — comprising the IFD and the IFR — addressed this mismatch by creating a new regime calibrated to the specific risks of investment business. Germany transposed the IFD through the WpIG, which entered into force on June 26, 2021. The new regime did not simply add to existing regulation; it replaced the investment-firm-specific provisions of the KWG with a standalone framework applicable to the full population of German investment firms, while leaving the true systemic firms — treated as credit institutions under the IFR — within the banking supervisory perimeter.

The transition itself was a substantial undertaking for existing investment firms. Firms that had been authorised under the KWG had to remap their capital calculations, reporting systems, and governance documentation to the new regime. BaFin published extensive transitional guidance, and most existing firms completed the transition within the planned timetable, though the reclassification of a handful of larger firms into Class 1 created particular complexity for those institutions.

Scope of the WpIG

The WpIG applies to Wertpapierinstitute — securities institutions — defined as entities providing investment services and activities listed in the Act. The services correspond to those defined under MiFID II (Directive 2014/65/EU) and include:

• Reception and transmission of orders in relation to financial instruments (Anlagevermittlung)
• Execution of orders on behalf of clients (Abschlussvermittlung/Orderausführung)
• Dealing on own account (Eigenhandel)
• Portfolio management (Finanzportfolioverwaltung)
• Investment advice (Anlageberatung)
• Underwriting of financial instruments or placing with firm commitment (Emissionsgeschäft)
• Placing of financial instruments without firm commitment (Platzierungsgeschäft)
• Operation of a multilateral trading facility (MTF) or organised trading facility (OTF)

A firm that provides one or more of these services on a commercial basis or on a scale that requires a commercially organised business undertaking must obtain prior authorisation from BaFin. The boundary between an activity that requires authorisation and one that does not is frequently subtle; many fintech business models involve elements that could arguably be characterised as investment advice, order execution, or portfolio management, and careful classification is essential before the product launches.

Relationship to MiFID II

The WpIG works alongside the Wertpapierhandelsgesetz (WpHG), the German implementation of MiFID II's conduct-of-business rules. In broad terms, the WpIG governs the prudential dimension — authorisation, capital, governance, reporting — while the WpHG governs the conduct dimension — client categorisation, suitability, best execution, conflicts of interest, inducements, product governance, and client communications. The two statutes together, supplemented by BaFin circulars and EU-level guidelines from the European Securities and Markets Authority (ESMA), define the full regulatory perimeter for German investment firms.

It is important for firms entering the German market to understand that authorisation under the WpIG does not carry automatic MiFID II conduct compliance. The two workstreams are related but distinct. A firm can have a robust governance framework and meet all prudential requirements while still being exposed to conduct-rule violations if its client onboarding, advice, and order handling processes do not fully implement the WpHG and its underlying delegated regulations. In practice, many firms build a combined compliance programme that addresses both dimensions together, with overlapping documentation where sensible.

The Three-Tier Classification System

The WpIG, reflecting the IFR structure, establishes a three-tier classification system for securities institutions based on size, complexity, and systemic importance. The approach follows the European principle of proportionality: firms that pose little risk to the financial system and to clients are subject to a correspondingly simplified framework, while systemically important firms come under full banking supervision.

• Class 1 (large): Securities institutions that deal on own account or underwrite and whose consolidated assets amount to EUR 15 billion or more. They remain securities institutions (‘large securities institutions’, section 2(18) WpIG) but must apply the CRR and large parts of the KWG instead of the IFR prudential rules. From EUR 30 billion, such a firm counts as a credit institution under the CRR and needs authorisation as a credit institution.
• Class 2 (non-small, non-systemic): Institutions that exceed specified K-factor, balance-sheet, off-balance-sheet, revenue, or activity thresholds but do not meet the Class 1 criteria. These are subject to the full IFR prudential framework, including detailed K-factor capital calculations, concentration-risk rules, and liquidity requirements.
• Class 3 (small and non-interconnected): Institutions that fall below all of the relevant thresholds, including limits on assets under management, client orders handled, own account activity, and balance-sheet size. These firms benefit from a simplified prudential regime with reduced capital, reporting, and governance requirements.

The classification is not a matter of choice; it follows automatically from the firm's activities and scale. A firm that grows beyond the Class 3 thresholds must transition into the Class 2 regime, and a firm that meets the Class 1 criteria must transition into full banking supervision. These transitions are significant events that require advance planning, and many WpIG-authorised firms monitor their headroom against the thresholds as a routine compliance activity.

The detailed thresholds that determine Class 2 versus Class 3 classification are set out in the IFR and cover a range of dimensions: assets under management, daily client orders handled, assets safeguarded and administered, client money held, daily trading flow, net position risk, clearing margin given, trading counterparty default exposure, total gross revenue, on- and off-balance-sheet exposures, and membership of a consolidated group. A firm must meet all of the applicable qualifying conditions to benefit from the Class 3 regime. Exceeding any single material threshold can push the firm out of the Class 3 category, and the classification rules contain specific procedures for the transition period in which a firm moves from one class to another.

In practice, many growth-stage fintechs start within the Class 3 regime and remain there through the early years of operation. Monitoring the classification headroom, particularly around client orders and assets under management, becomes a standing agenda item for the compliance function and a consideration in commercial planning — an ambitious marketing campaign could, if successful, push the firm into Class 2 and trigger a substantial regulatory upgrade. Experienced firms build these considerations into their growth plans from the outset.

Capital Requirements

The WpIG establishes minimum initial capital requirements that depend on the services applied for and on access to client assets, not on the firm's size class (section 17(1) WpIG). The headline figures, which apply at authorisation and as ongoing minimum own funds floors, are:

• EUR 75,000: For firms that provide only reception and transmission of orders (Anlagevermittlung), execution of orders in the client's name (Abschlussvermittlung), portfolio management, investment advice or placing without firm commitment, and whose authorisation rules out owning or holding client money or client securities.
• EUR 150,000: For all other firms that fall under neither the EUR 75,000 nor the EUR 750,000 tier, for example where the authorisation for those services does not rule out access to client money or client securities, for dealing in the firm's own name for the account of clients (Finanzkommissionsgeschäft) or for operating a multilateral trading facility.
• EUR 750,000: For firms that deal on own account under an authorisation for dealing on own account or underwriting, for operators of an organised trading facility that trade on own account, and for firms authorised for the safekeeping and administration of financial instruments (custody), securities-related lending, the restricted custody business or own-account business (Eigengeschäft).
• Full CRR capital requirements: For large securities institutions (consolidated assets of EUR 15 billion or more) and for firms that count as credit institutions from EUR 30 billion.

Beyond the initial capital floors, securities institutions must maintain ongoing own funds requirements calculated under the IFR framework. The Class 2 calculation is based on the K-factor system, which measures capital needs against Risk-to-Client (RtC), Risk-to-Market (RtM), and Risk-to-Firm (RtF) factors. RtC covers client money held, assets under management and safeguarded, and client orders handled. RtM covers net position risk and clearing margin given. RtF covers trading counterparty default, daily trading flow, and concentration risk. The aggregate capital requirement is the higher of the permanent minimum, one-quarter of fixed overheads, or the sum of the applicable K-factor requirements.

For Class 3 firms, the capital requirement is the higher of the permanent minimum and one-quarter of fixed overheads, with no K-factor calculation required. This simplification is one of the most significant advantages of the Class 3 regime and is deliberately designed to reduce the prudential burden for smaller firms.

Beyond the headline capital floors, firms must also consider the composition of own funds. The IFR imposes detailed rules on what can count as Common Equity Tier 1, Additional Tier 1, and Tier 2 capital, mirroring the CRR framework in its essentials. For most small fintechs, own funds will consist primarily of paid-up share capital and retained earnings, with limited use of the more complex capital instruments. Firms intending to rely on any instrument other than common equity should obtain detailed guidance, because the eligibility criteria are strict and misclassification can create unexpected capital shortfalls.

An additional practical consideration is the timing of capital contributions. BaFin expects the initial capital to be available at the point of authorisation, not on a promised basis. This has implications for funding strategies: relying on a planned capital raise that will close only after authorisation is a common mistake that delays or derails the application. Experienced founders ensure the capital is committed and available in the firm's accounts before submission of the application dossier.

Governance Requirements

The WpIG imposes governance requirements that include fit-and-proper assessments for managing directors (Geschäftsleiter), the establishment of appropriate internal control functions, and — for non-small institutions — the appointment of dedicated compliance, risk management, and internal audit functions. Managing directors must collectively possess the knowledge, skills, and experience necessary to understand the institution's activities, business model, and principal risks. BaFin assesses fitness and propriety on appointment and on any subsequent change, and imposes substantive standards for professional experience and time commitment.

BaFin's interpretation of governance requirements is informed by its existing supervisory practice and the guidelines published by the European Banking Authority (EBA) and ESMA on internal governance for investment firms. The practical standard expected is demanding. Managing directors are generally expected to have several years of relevant experience, to devote sufficient time to the role, and to demonstrate substantive understanding of the firm's business and risks. Supervisory board arrangements are scaled by institution size and complexity, with more extensive requirements for Class 2 institutions than for Class 3.

Internal Control Functions

Non-small securities institutions must establish three core internal control functions: compliance, risk management, and internal audit. These functions must be independent of the business lines they oversee, must have appropriate authority and resources, and must report to the management body on a defined schedule. The detailed expectations are set out in BaFin circulars and in the ESMA/EBA guidelines on internal governance. For Class 3 firms, the requirements are scaled down, but the underlying expectation of an effective control environment remains.

In practice, the compliance function is typically the first to be staffed in a new WpIG firm and has the broadest ongoing remit. It is responsible for ensuring adherence to the WpHG conduct rules, monitoring MiFID II-related obligations, maintaining the policies and procedures that govern the business, reporting to senior management and the supervisory board, and serving as the primary liaison with BaFin for day-to-day regulatory matters. The compliance function also typically owns the training programme and the breach-reporting process.

The risk management function is concerned with the identification, measurement, monitoring, and reporting of the risks to which the institution is exposed. For WpIG firms, this includes operational risk, conduct risk, reputational risk, liquidity risk, and, for firms dealing on own account, market risk. The risk management function works closely with the compliance function and, for larger firms, with a dedicated internal audit function that provides independent assurance over both.

Outsourcing Governance

Many WpIG firms outsource significant functions to third-party providers — IT hosting, KYC/AML services, compliance monitoring, transaction reporting, and back-office processing. Outsourcing is permissible under the WpIG but is subject to the same regulatory expectations that apply to banks: prior risk assessment, due diligence on the provider, detailed contractual provisions, ongoing monitoring, notification of material outsourcing, and maintenance of exit strategies. The Digital Operational Resilience Act (DORA) has added a further layer of obligations, particularly around the identification of critical ICT providers and the management of concentration risk in the provider ecosystem.

Reporting Obligations

Securities institutions are subject to regular reporting obligations to BaFin, with scope and frequency varying by classification. Class 3 institutions face relatively streamlined reporting covering basic own funds and simple indicators. Class 2 institutions must submit detailed reports covering own funds, K-factor calculations, concentration risk, liquidity, and large exposures. All institutions are subject to annual financial reporting requirements and must submit audited annual accounts prepared in accordance with German commercial law.

Beyond prudential reporting, securities institutions are subject to the transaction-reporting obligations under MiFIR, client-asset reporting under MiFID II, and various conduct-related reporting obligations under the WpHG. The aggregate reporting burden can be substantial, and many fintechs invest significantly in regulatory technology (RegTech) solutions to automate the data collection, validation, and submission processes.

The MiFIR transaction-reporting regime deserves particular attention. Every executed transaction in a reportable financial instrument must be reported to the national competent authority no later than the end of the following working day, with a specified set of data fields covering the instrument, the counterparties, the timing, the price, the quantity, and the execution venue. Errors in transaction reporting attract significant supervisory attention, and a persistent pattern of errors can result in enforcement action. Firms new to the regime are well advised to rely on established transaction-reporting providers rather than attempting to build bespoke reporting capability in-house.

MiFID II Conduct Rules

Alongside the WpIG prudential framework, German investment firms must comply with the MiFID II conduct rules implemented through the WpHG. These include:

• Client categorisation as retail, professional, or eligible counterparty, with differentiated protections across categories
• Suitability and appropriateness assessments, particularly for investment advice and portfolio management
• Best execution obligations, including an execution policy and evidence of compliance on request
• Conflict-of-interest identification, management, and disclosure
• Inducements rules, with particular focus on independent advice and portfolio management
• Product governance requirements covering target market identification and distribution arrangements
• Client reporting obligations including periodic statements and trade confirmations
• Recording of client communications including telephone calls and electronic messages

Each of these conduct obligations has significant operational implications. Taken together, they define much of the day-to-day compliance work of a WpIG-authorised firm.

Client categorisation is perhaps the most foundational of these obligations because the level of protection afforded to a client flows directly from the category to which the client is assigned. Retail clients enjoy the highest level of protection; professional clients and eligible counterparties are assumed to have the knowledge and resources to protect their own interests and accordingly receive fewer regulatory safeguards. The process of categorising clients, documenting the basis for the categorisation, and handling requests for recategorisation must be embedded in the firm's onboarding process from the first day of operations.

Suitability and appropriateness assessments, best execution monitoring, inducements disclosures, and product governance arrangements each generate their own documentation trails, and a thorough WpIG firm maintains auditable records that can be produced on demand during a supervisory review. The recording of telephone calls and electronic communications relating to transactions is another significant operational obligation, requiring secure storage, retrieval capability, and retention periods typically of five years or more.

The EdW Compensation Scheme

German securities institutions are members of the Entschädigungseinrichtung der Wertpapierhandelsunternehmen (EdW), a statutory compensation scheme covering claims against insolvent investment firms for client money and securities up to defined limits. Membership follows from the authorisation itself and does not depend on whether the firm holds client assets: every securities institution authorised for the investment services listed in the Investor Compensation Act (Anlegerentschädigungsgesetz) must belong to the scheme, and annual contributions are calculated based on each institution's relevant business volumes. For fintech firms, assignment to the EdW is therefore part of the overall authorisation timeline, even without access to client money or financial instruments.

DORA Compliance

The Digital Operational Resilience Act (DORA), which became applicable on January 17, 2025, applies to WpIG-authorised investment firms alongside the full population of EU financial entities. DORA imposes extensive requirements covering ICT risk management, ICT-related incident reporting, digital operational resilience testing, management of ICT third-party risk, and information sharing on cyber threats. For technology-heavy fintech firms, DORA compliance has substantially raised the regulatory bar and has required meaningful investment in ICT governance, vendor management, and incident response capabilities.

Anti-Money Laundering Obligations

Securities institutions are obliged entities under the Geldwäschegesetz (GwG), the German anti-money-laundering law. This brings with it customer due diligence obligations, transaction monitoring requirements, suspicious activity reporting to the Financial Intelligence Unit (FIU), record-keeping duties, and the appointment of a money laundering reporting officer. For firms with retail or cross-border customer bases, the AML workload is substantial and requires dedicated resources and systems from the outset.

Customer due diligence under the GwG follows a risk-based approach, with simplified measures permissible in defined low-risk scenarios and enhanced measures required where higher risks are identified. For onboarding of individual retail clients, the standard approach involves verification of identity through official documents, assessment of beneficial ownership where relevant, establishment of the purpose and nature of the business relationship, and ongoing monitoring throughout the relationship. Cross-border clients, politically exposed persons, and clients from higher-risk jurisdictions trigger enhanced due diligence obligations.

Suspicious activity reporting is arguably the most consequential element of the AML regime. The reporting threshold is intentionally low, and firms are expected to err on the side of reporting when they have grounds for suspicion. The German FIU is the central recipient of reports and has published typologies and indicators to assist obliged entities. Training of front-office and compliance staff to recognise suspicious patterns is a baseline expectation, and BaFin supervisory reviews of AML frameworks frequently examine training records and reporting histories.

The Application Process

The WpIG authorisation process can be broken into four broad phases. Understanding the shape of each phase helps firms plan realistic timelines and avoid the most common pitfalls.

Phase 1: Pre-Application Preparation

Before any formal submission, firms should conduct a detailed regulatory gap analysis, define the target classification, identify the key-person appointments, draft the business plan and financial projections, and consider approaching BaFin, for instance through its contact point for fintechs, for a preliminary orientation discussion. This phase typically lasts several months and is often the stage where the greatest external support is valuable.

A common and costly error is to attempt to run Phase 1 in parallel with product build-out. The preparation phase is not merely administrative; it involves substantive decisions about corporate structure, business model boundaries, data handling, capital composition, IT architecture, and outsourcing relationships. Decisions taken during product development without reference to the emerging regulatory framework frequently have to be revisited later, sometimes at significant cost. Firms that treat Phase 1 as a genuine strategic project — engaging senior leadership, compliance expertise, and legal counsel — typically arrive at Phase 2 with materially better foundations.

Phase 2: Application Development

The core application dossier includes the business plan, financial projections, organisational charts, descriptions of the governance and control framework, compliance policies, risk management framework, IT infrastructure documentation, AML policies, outsourcing register and related documentation, fitness-and-propriety documentation for managing directors and supervisory board members, ownership information, and evidence of initial capital. Assembling this dossier to BaFin's quality standards is a substantial undertaking.

Applications to BaFin have been possible wholly or partly in English since the end of 2023; BaFin may, however, request a translation at any time, and in that case only the German version is legally binding (section 4j FinDAG). Whatever the language, BaFin expects the dossier to follow a structured, coherent layout. Cross-references between documents must be clean, contradictions between the business plan and the compliance documentation must be avoided, and the assumptions behind the financial projections must be set out transparently. Dossiers that appear to have been assembled from reused templates without adapting the content to the specific business regularly end up in longer review loops and are a frequent reason for a considerably longer Phase 3.

Phase 3: BaFin Submission and Review

Once submitted, the application enters the BaFin review process. This typically involves multiple rounds of questions and follow-up requests, meetings with supervisors, and iterative refinement of the documentation. The quality of the initial submission has a direct impact on the duration of the review phase.

During Phase 3, BaFin will generally assign a dedicated supervisory contact to the application and will schedule meetings with the firm's management, compliance function, and key operational leads. These meetings are not ceremonial; supervisors use them to probe the firm's understanding of the applicable rules, the substance behind the documentation, and the readiness of the organisation to operate under the obligations. Managing directors should expect to be asked detailed questions about their plans for handling specific risks, scenarios, and operational challenges, and they should be able to answer without reliance on prepared scripts or external advisers.

Phase 4: Post-Authorisation Setup

After authorisation is granted, the firm must complete its operational setup, including finalising contracts with external service providers, onboarding to regulatory reporting systems, activating the EdW membership where applicable, and launching the first live operations under the new authorisation. The first supervisory cycle is a critical period in which BaFin tests whether the firm actually operates in line with the profile described in the authorisation dossier.

Timeline Expectations

Realistic timelines for a full WpIG authorisation, from start of serious preparation to granted authorisation, are commonly in the range of twelve to fifteen months, sometimes longer for more complex business models or when the initial documentation requires substantial rework. Firms that rush the preparation phase typically spend longer in the review phase than firms that invest adequately in Phase 1 and Phase 2.

Cost Expectations

The total cost of obtaining a WpIG authorisation varies widely by business model and complexity, but firms should budget for meaningful professional fees (legal, accounting, compliance consulting), initial capital that is effectively committed for the long term, ongoing staffing of the control functions, technology investment, and BaFin fees. For many fintech founders, the realisation that the authorisation is the start rather than the end of significant regulatory expenditure is a critical planning insight.

Relevance for Fintech Companies

The WpIG framework is directly relevant to several categories of fintech companies operating in Germany. Neo-brokers offering fractional share trading and simple execution-only services, robo-advisors providing algorithmic portfolio management, and tokenised securities venues fall within its scope. Crowdfunding platforms are the exception: a platform authorised as a crowdfunding service provider under Regulation (EU) 2020/1503 does not count as a securities institution for those services (section 3(1) no. 22 WpIG) and needs a WpIG authorisation only for activities that go beyond them. The proportionate nature of the framework — with lighter requirements for Class 3 institutions — is designed to accommodate the business models of these firms without imposing the full weight of banking regulation.

For many fintech founders, the WpIG represents the most realistic path to direct authorisation, offering a genuinely lighter touch for smaller and less complex firms while preserving full market access. Firms that conclude that their model does not justify direct authorisation often operate instead through tied-agent arrangements or through BaaS partnerships with a WpIG-authorised or bank-licensed institution.

For neo-brokers, the WpIG regime is typically the right framework as long as the business model stays within receiving and executing orders; keeping custody accounts is possible as an ancillary service but raises the initial capital to EUR 750,000. Once the model includes taking deposits or granting loans outside securities-related lending, however, additional authorisation requirements under the KWG can arise. Carefully drawing the line between securities-related and banking-type activities is therefore an essential element of the regulatory strategy.

Robo-advisors offering algorithmic portfolio management are a particularly interesting case. Although the underlying service of portfolio management has long been anchored in German supervisory law, automating the investment decision raises specific questions: how suitability assessments are carried out, how model errors are controlled, how clients are informed about the algorithmic nature of the recommendations, and how regular portfolio reviews are documented. BaFin has published its positions on these topics, and firms should build them into their compliance design.

Common Pitfalls

Recurring pitfalls in WpIG licensing include underestimating the quality expectations for the business plan and financial projections, failing to appoint managing directors with sufficient regulatory experience, treating the governance framework as a template exercise rather than a substantive design, underestimating the AML and conduct workload, and attempting to file an application before the underlying business is ready to operate under the obligations. Firms that fail their first review round often face months of additional work and associated cost.

A further pitfall is the mismanagement of the relationship with BaFin during the review process. Supervisors expect professional, responsive, and candid engagement. Defensive posturing, delays in answering questions, attempts to minimise risks, or inconsistent messaging across different communications all erode supervisory confidence and can extend the review significantly. The most successful applicants treat BaFin as a partner in the process rather than an adversary, even when the supervisor's questions are demanding.

The WpIG-KWG Boundary

One of the more consequential aspects of the WpIG framework is the boundary with full banking supervision. A firm that grows beyond the Class 1 thresholds transitions out of the WpIG prudential regime into the KWG/CRR framework. This is not a minor adjustment; it involves a substantial increase in capital and reporting obligations and typically requires meaningful operational change. Firms that are approaching the threshold should plan the transition carefully, ideally through early dialogue with BaFin and with the advice of experienced counsel.

Practical Preparation Guidance

Firms considering a WpIG licence should engage early with BaFin, ideally through BaFin's contact point for fintechs, to clarify the applicable classification and the specific requirements that will apply to their business model. They should invest in a high-quality business plan, recruit experienced managing directors, build a credible governance framework, and prepare for the detailed documentation burden. The licensing process, while less lengthy than a full banking licence application, still demands thorough preparation. Firms that treat the WpIG application as a serious regulatory project rather than an administrative formality generally achieve faster and cleaner outcomes.

The firms that succeed under the WpIG framework are typically those that take the regulatory dimension seriously from the outset, invest in sound governance and compliance infrastructure, and build the operational capability to demonstrate — not just describe — compliance with the applicable rules. The reward for this investment is access to one of the largest and most important investment-services markets in Europe, with a regulatory framework that is demanding but fundamentally supportive of well-run firms.