One ICT incident, four regulatory questions at once. We give you one record to answer from.
When an execution venue connection drops, a MiFID investment firm has to work out, in real time, whether that is a DORA major incident, a best-execution exception, an IFD risk-to-client item for the ICARA, and a client-asset notification, sometimes all four. Client and counterparty due diligence runs alongside on its own AML track. Our platform holds the venues, suppliers, and AML casework as one set of records rather than four. The class-specific prudential and conduct rulebooks, IFR/IFD and MiFID II, stay with our specialists, working from that same data.
A dropped connection, and four clocks start at once.
A MiFID firm's execution venue connectivity, order-management system, and post-trade reporting pipeline are all ICT third-party services. When one of them fails, the compliance team has to work out, under deadline, whether that is a DORA major incident, a best-execution exception, a risk-to-client item for the IFD ICARA, or a client-asset notification, and often it is more than one. Most firms triage this by memory and precedent, not by a system that already knows the answer.
The client and counterparty side runs its own AML/KYC track in parallel: PEP and sanctions screening, source-of-funds checks, beneficial-ownership look-through, none of which shares a record with the execution-venue supplier data even though both sit in the same compliance function.
Class adds a further layer. A Class 2 firm owes the full ICARA under IFD Article 24; a Class 3 firm owes a simplified version but still a full DORA Register of Information. Getting the class-specific scope wrong is its own risk, on top of the operational one.
The venue is one object. The incident record already knows what it touches.
On the platform, an execution venue, an order-management system, or a market-data provider is a single supplier object. The contracts, the functions they support, and the ICT assets downstream are connected records, not a separate spreadsheet. The Register of Information reads directly from that graph.
Incident management runs as a workflow against those same objects, so when a venue connection fails, the incident record already carries the classification data (which function, which supplier, which criticality) that a DORA major-incident assessment needs, behind a four-eye approval gate. AML/KYC casework, PEP and sanctions screening, source-of-funds, beneficial-ownership look-through, runs on the platform against the firm's own client and counterparty records, not a bridge to a separate system.
What this does not claim: the platform does not produce the ICARA narrative or decide whether a given incident is a MiFID best-execution exception. Those interpretation calls stay with our specialists, using the same supplier and incident data as their starting point.
DORA, AML/KYC, and supplier risk. ICARA and MiFID interpretation stay advisory.
When an investment firm is onboarded, the platform activates the DORA Register of Information across all fifteen RT/B tables with a submission-ready XBRL-CSV package and GLEIF/LEI verification, scoped to the firm's class. Supplier risk, execution venues, OMS providers, market-data feeds, covers the register, AI-assisted and privacy assessments, and contractual arrangements as first-class objects.
AML/KYC runs in the platform: case management, PEP and sanctions screening, source-of-funds, and beneficial-ownership look-through per the AMLR, with every material step behind a four-eye approval gate. Incident management is workflow-integrated against the same supplier and function data, and policy generation and health checks run alongside.
Our specialists produce the ICARA itself, the risk-to-client, risk-to-firm, and risk-to-market narratives under IFD Article 24, using the platform's governance and supplier data as input. MiFID II interpretation, best-execution policy, product governance, inducement assessment, sits with them too, with the decision record stored against the platform objects it concerns.
Class scoping and conduct interpretation stay with people.
Whether an incident counts as a best-execution exception, how the ICARA should weigh a concentration risk, and how the firm's class shapes what IFD actually requires are calls that need a person who has done this before. Our specialists, several former AFM or DNB supervisors and buy-side or sell-side compliance officers, make that call and write the reasoning down against the record it concerns.
That written trail is what turns a triage decision from something remembered into something shown. When a supervisor asks why an outage was or was not treated as a DORA major incident, the classification and the reasoning are both already in the record.
You own the platform, the data as adapted to your operation, and the written record of every interpretation decision. Advisory work continues on ICARA and MiFID conduct for as long as your class and authorisation require it.
A discovery call, not a product demo.
You describe the compliance problem consuming the most of your team's time. We walk the platform through an example close enough to your operation that you can judge whether this way of modelling compliance fits how you want to work.
Book a discovery call →