We check your actual operations (client files, recordings, contracts and reports) against what MiFID II requires. You receive prioritized findings, the missing evidence and a remediation plan with an owner and a date.
Would you like an independent MiFID II audit?
Tell us what type of firm you are and what services you provide, and we will propose a scope, sample and timeline, with no commitment.
Six areas where findings cluster. We review them on your real client files, not on the table of contents of your manuals.
We go through the entire client cycle: classification, prior assessment, pre-contractual information, costs, inducements, execution and follow-up. We compare each written policy with what actually appears in the client file.
We ask for the same documents, in the same format and with the same urgency as the supervisor would. If your team cannot find them, the problem is not the policy: it is traceability.
A sample of real clients: an up-to-date test, consistency with what was recommended, sustainability preferences and the report delivered.
We check that the prior information and the annual report exist, are consistent with each other and show the cumulative effect on return.
A map of flows with third parties, their fit with the service you provide and proof of the quality enhancement that justifies them.
The scope of channels covered, non-corporate messaging, retrieval by client and date, and the retention periods applied.
Four situations that keep coming up. In none of them are sanction proceedings open: in all of them, someone would rather find out first.
“We were authorized years ago, and since then we have doubled our clients and broadened our range. The manuals are still the ones from the original application, and nobody has checked whether anyone applies them.”
“I have just taken over the compliance function. Before I sign my first report to the board, I want to know exactly what I am inheriting, and I want someone from outside to tell me.”
“We market our products to retail clients, and the target market was defined some time ago. I need to know whether our product governance can withstand an external review.”
“The group requires an independent local review against Spanish rules. We want a report with findings, criticality and an action plan that head office can read and follow.”
When we review firms that are already authorized, the same three almost always come up. None of them shows when you read the manual: they show when you open a client file at random.
The policy exists, but nobody applies it: flawless manuals inherited from the authorization application that no relationship manager has read. In a request for information, it is not the table of contents of the manual that gets examined: it is the client file.
Outdated suitability: tests signed years ago, portfolios that no longer fit the declared profile and sustainability preferences that were never asked about. It is the most expensive finding to fix retroactively.
Scattered evidence: the information exists, but it is spread across the CRM, a relationship manager’s email and a shared folder. If you cannot rebuild a specific case within hours, for practical purposes you do not have it.
| Area reviewed | Common finding | Evidence that closes it |
|---|---|---|
| Suitability | Test expired or inconsistent with the recommended portfolio | An up-to-date test, a suitability report delivered to the client and traceability of each recommendation. |
| Inducements | Third-party payments without justification of the enhanced quality of the service | A map of flows, a catalog of documented quality enhancements and prior and periodic disclosure to the client. |
| Recording | Orders and instructions that come in through channels that are not covered | An approved scope of channels, proof of retrieval by client and 5-year retention, extendable to 7 years on request. |
We review your MiFID II compliance the way the supervisor would: a sample of real client files, interviews with your team and traceability testing. You come away with a report of prioritized findings and a remediation plan that you can carry out and show.
It is an independent review of how you apply the MiFID II conduct rules day to day: client classification, suitability and appropriateness, cost disclosure, inducements, recording of communications, product governance and best execution.
It is not a course or a report on what the directive says. It is fieldwork: we take a sample of your client files, interview the people who deal with clients and check whether what your manual says can be proven with documents. The result is a list of findings rated by criticality and a plan to close them.
They are two different moments. In MiFID II compliance, we build the system: policies, templates, contracts and procedures. In the audit, we check whether that system (ours or the one you already had) works on real clients.
If you have never set up the framework, start with the compliance service. If you have had it for some time and do not know what state it is in, start with the audit: the diagnosis will tell you where it is worth investing. For the full regulatory context, see MiFID II.
When we start, we send you a closed request list. In general terms, we ask for: current policies and manuals with their approval date, standard client contracts, suitability and appropriateness test templates, ex ante and ex post cost disclosure templates, the product catalog and its target market, agreements with third parties that generate payments received or made, the best execution policy, a map of recorded channels and the staff training register.
Then we select the sample of specific client files. That is where most of the findings turn up.
Very little. Most of the work is document review, which we carry out with the information you provide. We do, however, need short interviews with the key people: whoever deals with clients, whoever prepares the cost information, whoever manages the systems and whoever performs the compliance function.
Those conversations are essential because the typical finding is not “a document is missing” but “the document exists, but the relationship manager does something else.” The total duration depends on the size of the firm, the number of services and the volume of client files included in the sample.
Three pieces. First, the audit report, describing each finding, the regulatory standard it is measured against, the evidence examined, the associated risk and the specific recommendation. Second, the remediation plan, with the action, internal owner and closing date for each item. Third, the evidence folder, organized by subject, so that you can answer a request for information without rebuilding anything.
If you wish, we add a presentation session for the management body: approval of the plan must be documented.
They are prioritized and closed. High-criticality findings (those that affect client protection or leave the firm without proof) are tackled first, usually with quick measures: updating templates, reopening expired tests, closing communication channels that are not covered.
Structural findings need a project: redesigning the cost workflow, reviewing product governance or reorganizing the archive. We can carry out the remediation with you or limit ourselves to monitoring progress and verifying closure. What matters is that the plan has dates and that someone is accountable for each one.
Yes, but the order of work changes. With a request on the table, the first step is to prepare a complete, consistent and timely response; the general review comes afterwards, so that the next question does not catch you in the same position.
What does not work is improvising: contradictory answers from different departments and evidence that turns up half complete are what turn a supervisory action into something more serious. We explain how a supervisory action unfolds and how to respond in CNMV supervision and inspection.
What the rules require is that you have a compliance function that periodically reviews and assesses the adequacy and effectiveness of your policies and procedures and reports its conclusions to the management body. How you organize that review is up to you.
An external review brings two things that an internal one cannot always provide: real independence and experience compared across other firms. It also leaves a dated document proving that the firm assesses itself, which counts in your favor when a supervisory action arrives. For EAFs, it also fits in with the rest of the post-authorization obligations.
Auditing is not rereading manuals: it is checking whether your operations leave a trail. This is the path we follow, from scope to closing the findings.
We define which services you actually provide and to which clients, agree on the areas included in the review and select the sample of client files: by product, by relationship manager and by edge cases. Without a written scope, the audit loses focus.
Document review, interviews with the people who deal with clients and traceability tests: we ask you for a specific client file and measure how long it takes you to put it together in full. Everything is supported by working papers.
Findings prioritized by criticality, an action plan with an owner and a date, a presentation to the management body and, if you engage us for it, verification of closure after a period of time. The audit ends when the findings are closed, not when the PDF is delivered.
If what you need is to build the framework from scratch, start with our MiFID II compliance service. If you are already authorized, also review the calendar of ongoing obligations.
The 10 conduct controls the CNMV expects to see working in an EAF or investment firm, with the typical evidence for each one. Ideal as a quarterly self-assessment with your team.
No spam. Your email is only used to send you this checklist and, occasionally, relevant regulatory updates.
The checklist is downloading now. If it does not start automatically, click here.
Need help implementing any of the steps after reading it? Write to us directly:
Terms you will see in the proposal, in the report and in conversations with your management body. They should mean the same thing to everyone.
A comparison between what the MiFID II conduct rules require and what your actual client and transaction records can prove.
An initial document that sets the areas reviewed, the period examined, the units involved and the limits of the work. It is agreed before starting.
A selection of specific cases by product, relationship manager and client type, including the edge cases where the process tends to break down.
A proven gap between the regulatory requirement and the observed practice, with the evidence examined and the risk it creates.
Classification of the finding by its impact on the client, how often it recurs and the firm’s ability to prove otherwise.
The translation of each finding into a specific task with an internal owner and a closing deadline, approved by the management body.
The function that periodically reviews and assesses the adequacy and effectiveness of policies and procedures and reports to the management body.
The internal support for each check: what was reviewed, on which document, on what date and with what conclusion.
A file organized by subject with current policies, evidence and records, ready to answer a request for information without improvising.
Category assigned under Annex II of MiFID II and communicated to the client, with changes of category justified and documented.
Client record with category and date, communication to the client, reclassification requests and the analysis supporting them.
An up-to-date suitability test before each recommendation (MiFID II Art. 25) and an appropriateness test for non-advised services on complex products.
Completed and dated questionnaires, the suitability report delivered, warnings when the result is negative and a record of the execution-only exemption.
Third-party payments only where MiFID II Art. 24 allows them, with a documented quality enhancement, plus ex ante and annual ex post cost information.
Third-party contracts, a chart of flows, a catalog of documented enhancements and a sample of cost reports delivered and reconciled.
Recording of conversations and communications that may result in transactions (MiFID II Art. 16(7)), even if the transaction is not executed.
An inventory of channels, a device policy, proof of retrieval of a specific communication and 5-year retention, extendable to 7 years on request.
Positive and negative target market defined and applied (MiFID II Arts. 16(3) and 24(2)) and the Art. 27 best execution policy reviewed.
A product governance sheet per instrument, feedback to the manufacturer, the execution policy and the minutes of its review.
If you recognize two or more, your exposure is not in the manual: it is in the client file someone is going to ask you for.
Almost no review ends within its own scope. A finding on inducements opens up the conflicts register; one on suitability opens up team training; one on traceability opens up the archive. These are the pages where we cover each area in depth.
Conflicts map, organizational measures and register. It is the first document requested when third-party payments appear.
Reporting, audit, fees and ongoing compliance: the calendar that the audit checks you are meeting.
The full regulatory context: the directive, the delegated regulation and the conduct rules tested in the review.
If the finding is that the relationship manager did not know how to apply the policy, the problem lies in proving training, not in drafting.
If what you are facing is a supervisory action, start with CNMV supervision and inspection and the CNMV sanctions regime. If you want to set up the complete system before auditing it, go to MiFID II compliance.
Tell us what investment services you provide and where your MiFID II compliance stands: we will tell you what to review first and in how much depth.
Last updated: August 4, 2026
A MiFID II compliance audit does not explain the rules: it tests them against your operations. The reference framework is Directive 2014/65/EU (MiFID II), Regulation (EU) 600/2014 (MiFIR) and Delegated Regulation (EU) 2017/565, applied in Spain through Law 6/2023 and Royal Decree 813/2023. The review measures one thing only: whether each conduct obligation leaves a documentary trail that you can show the CNMV without rebuilding anything. We work on real client files, interview the people who deal with clients and deliver prioritized findings with a remediation plan you can carry out.
The scope is the full client cycle. It starts with classification (retail, professional or eligible counterparty under Annex II of MiFID II), because the protections owed and the warnings required depend on it. It continues with the prior assessment: the suitability test where there is advice or portfolio management (MiFID II Art. 25), with the sustainability preferences incorporated by the ESMA suitability guidelines updated in 2023, and the appropriateness test for non-advised services on complex products, with its warnings regime and the execution-only exemption. It moves on to economic transparency: ex ante and annual ex post cost and charges disclosure, aggregated, with an itemized breakdown on request and the cumulative effect on return (MiFID II Art. 24(4) and Art. 50 of Delegated Regulation (EU) 2017/565), and the Art. 24 inducements regime, under which inducements are prohibited in independent advice and discretionary portfolio management. And it closes with the recording of communications under Art. 16(7), product governance under Arts. 16(3) and 24(2) with its positive and negative target market, best execution under Art. 27 and the management of conflicts of interest.
The methodology is deliberately uncomfortable, because it replicates the supervisor’s logic. First, the scope is set in writing: areas, period examined and units involved. Then the sample is selected, and it is selected by the auditor, not by the firm being audited: client files by product, by relationship manager and by edge cases (reclassified clients, complex products, client-initiated transactions, old contracts nobody has looked at since). Two things are done on that sample. One, document review: checking that each document exists, is signed, is current and is consistent with the next link in the chain. Two, traceability tests: asking for a specific case and measuring how long the firm takes to put it together in full, because evidence that takes weeks to appear is of no use in answering a request for information. On top of this come short interviews with whoever deals with clients, whoever prepares the cost information and the compliance function. Everything is supported by working papers that allow the review to be rebuilt years later.
The report is not a list of reproaches. Each finding is documented with four elements: the specific regulatory requirement, the evidence examined, the deviation observed and the operational recommendation. Each one is assigned a criticality rating, which sets the order of work: first, what affects client protection or leaves the firm without proof; then, the structural issues. From this comes the remediation plan, which is the part that actually gets used: a table with the action, internal owner and closing date, designed to be taken to the management body and approved in the minutes. We close with the evidence folder, organized by subject, so that the firm does not have to look for the same documents again next time. If you engage us for it, we verify closure after a period of time and record which findings were resolved and which remain open, with the reasons. That trail (self-assessment, approved plan and follow-up) is exactly what shows that the firm monitors itself.
There are four natural moments: when the business model or product range changes, when a new compliance officer joins, when a complaint challenges a specific recommendation and when the supervisor makes a move. The CNMV supervises on an ongoing basis, both remotely and on site, and its approach is always the same: it does not ask what your manual says; it asks you to show it the case. We cover this in CNMV supervision and inspection. Securities market legislation classifies infringements as minor, serious and very serious, and the range of consequences runs from fines to public reprimand, revocation of the authorization or disqualification from office; the details are in CNMV sanctions. Against that, a dated independent review, with its approved plan and its follow-up, is the difference between a firm that corrects and a firm that finds out the hard way. If yours is an EAF that is already authorized, fit it into the calendar of ongoing obligations.
This content is for general information only and does not constitute legal advice. The legislation cited may have been amended after the update date shown: always check the version in force or contact us to analyze your specific case.
Key legislation, linked to the official text:
Legislation and links reviewed in .