Unlike quite a few compliance restrictions, SOC compliance is typically not required to operate inside of a given sector like PCI DSS compliance is for processing payment card data. Normally, organizations require a SOC audit when their prospects ask for one. Share your views on EU legal guidelines and policies, https://www.nathanlabsadvisory.com/finra.html