Regulatory Framework and Supervisory Requirements
Who Regulates What
Candidates must be able to map each activity to its regulator and rulebook, and to distinguish statutory powers from supervisory guidance. Core concepts: the difference between primary legislation, delegated regulation, and non-binding guidance; authorisation versus registration versus notification; passporting and cross-border provision of services; the supervisory review and evaluation process; and the escalation ladder (moral suasion, supervisory measures, enforcement, licence withdrawal).
Traps
Questions frequently test the difference between a requirement and an expectation. Guidance is not directly enforceable, yet supervisors may treat persistent disregard as evidence of weak governance. Another trap is confusing authorisation of a firm with approval of a product or individual; many regimes require separate notifications for new products, outsourcing, or changes in control. Watch for jurisdiction-neutral wording: the correct answer is usually the one describing the principle rather than naming a specific national statute.
Rule of thumb
Ask three questions in order: (1) Is this a legal obligation or a supervisory expectation? (2) Which entity in the group is the regulated one? (3) Does the activity require prior notification or approval? If any answer is unclear, the safest answer is the one requiring the firm to notify and document its rationale.
Worked example
A firm plans to outsource a core settlement function to a group affiliate abroad. The trap answer is "permitted because intra-group." The correct reasoning: outsourcing to a group company is still outsourcing; material outsourcing typically requires prior notification, due diligence, an exit plan, and access-to-information clauses for the supervisor.