Europe Investment Report 2018 — Regulation as an Export

Europe's position in global technology through this period is frequently summarised as failing to produce large platforms. That summary is accurate and incomplete, because it measures Europe against the wrong variable.

Europe's effective instrument was not company formation. It was rulemaking, and 2018 is the year that became unmistakable.

Two regulatory changes took effect that reached well beyond European borders. A comprehensive data protection regime established requirements for how personal data is collected, stored, processed and transferred — applying to any organisation handling European residents' data regardless of where it is located. And a revision of financial markets rules changed how investment research is paid for, with consequences for equity market structure that were largely unintended.

The transmission mechanism is worth understanding precisely, because it is not primarily legal. A regulator's formal reach is limited. What extends it is a cost asymmetry inside the regulated firm.

Building two systems — one compliant, one not — costs more than building one compliant system. Data architecture, consent mechanisms, retention policies and access controls are expensive to build once and disproportionately expensive to build twice, plus the ongoing cost of correctly routing every user to the right system and the risk of getting it wrong.

So firms build one system to the strictest applicable standard, and that standard propagates to every market they operate in. A regime with a large enough market to be worth complying with therefore sets the global floor, without any extraterritorial claim.

The consequences for investors were substantial and ran in directions policymakers did not fully intend, which is the substance of this report.

Why the strictest regime sets the standard

The cost asymmetry deserves setting out step by step, because it explains the whole phenomenon and generalises well beyond data protection.

The firm's decision. A company operating in several jurisdictions with different requirements can either build separate systems per jurisdiction, or build one system meeting the strictest requirement.

Why one system usually wins:

• Fixed costs dominate. Building a compliant data architecture is largely a one-time engineering cost. Building two is nearly twice that cost for the same product.
• Routing is a permanent operational burden. Two systems require correctly identifying which applies to each user, at every interaction, forever. That is an ongoing cost and an ongoing failure mode.
• The failure mode is asymmetric. Applying the strict standard to a user who did not require it costs nothing. Applying the loose standard to a user who required the strict one is a violation with penalties.
• Product complexity compounds. Two systems means two versions of every feature that touches the regulated domain, forever, including every future feature.

So the rational choice is one system at the strictest standard, and the strictness propagates globally.

The condition for this to work is that the strict jurisdiction is large enough to be worth serving. A small market's rules do not propagate, because a firm will simply exit it. A market of several hundred million consumers is not exitable for most global businesses.

A regulator with a large enough market does not need extraterritorial reach. It only needs to make selective compliance more expensive than universal compliance, and firms export the standard themselves.

This is Europe's genuine global instrument, and it is available to it precisely because it is a large integrated consumer market — the same integration whose fragmentation costs on the supply side the 2015 report describes. Europe's demand side is integrated enough to set global rules and its supply side is fragmented enough to struggle to scale companies. That asymmetry is the central irony of the period.

Compliance cost as a barrier to entry

The most consequential and least intended investment effect concerns who bears the cost.

Compliance cost is largely fixed. Building a compliant data system, appointing the required roles, documenting processes and conducting assessments costs roughly the same whether a company has ten thousand users or ten million.

A fixed cost divided by revenue falls as revenue rises. So:

• A large incumbent absorbs it easily. The absolute cost may be large; relative to revenue it is small, and the company already has legal and compliance functions.
• A small entrant absorbs it with difficulty. The same absolute cost against a fraction of the revenue, borne by a company with no compliance function, funded by capital that would otherwise build product.
• The gap widens the barrier to entry in exactly the categories the rules were partly intended to make more competitive.

The empirical pattern following such regimes is consistent across jurisdictions and sectors: market concentration in the affected categories tends to increase rather than decrease, because compliance advantages scale.

This is not an argument against the regulation. The protections it establishes have value that is not captured in a competitive-effects analysis, and the analysis here is about a side effect rather than about the merits. But the side effect is real, it is predictable from the cost structure, and it should be modelled by anyone assessing companies in a newly-regulated category.

The investment implications are direct:

• Incumbents in newly-regulated categories are relatively advantaged, and the advantage is durable because it is structural.
• Early-stage companies in those categories carry a cost that does not scale with their size, which affects capital efficiency and therefore how much they must raise.
• The cost is a moat once paid, which means a company that has built compliant infrastructure has an asset that a new entrant must replicate.

Data reframed from asset to liability

A change in how data-dependent business models should be valued followed from the regime, and it took several years to be reflected in practice.

The prior framing. Data was an asset. A company accumulating user data was building something valuable — a moat, a training corpus, a targeting capability. Accumulation was strategy.

The revised framing. Data carries obligations: to obtain valid consent, to store securely, to delete on request, to transfer on request, to disclose breaches, and to justify each processing purpose. Data a company holds without a clear purpose is a liability with no offsetting benefit.

The consequences for valuation:

• Data volume stopped being straightforwardly positive. A large corpus collected without adequate consent basis is a risk, not an asset.
• Consent quality became a diligence item. Whether a company's data was collected on a basis that survives scrutiny determines whether it can continue to be used — which determines whether the business model works.
• Purpose limitation constrained expansion. Data collected for one purpose cannot freely be used for another, which limits the adjacent-product strategies that data-rich companies had relied on.
• Cross-border transfer became a live risk for businesses moving data between jurisdictions, requiring mechanisms whose validity has been repeatedly litigated since.

For investors, the practical requirement was a new diligence category: not what data does the company hold, but on what basis, for what purposes, and with what transfer arrangements. A company whose model depends on data it cannot demonstrate a lawful basis for is a company whose model may not survive an enquiry, and that risk is not visible in any financial statement.

Research unbundling and the small-cap problem

The financial markets rules revision produced an effect on equity market structure that was largely unintended and that worsened a problem this sequence keeps returning to.

What changed. Investment research had historically been paid for implicitly, bundled into trading commissions. The revised rules required research to be priced and paid for separately.

The intent was transparency — investors should know what they pay for research and be able to assess whether it is worth it.

What happened:

• Research budgets were cut. Once research is a visible line item rather than an implicit cost, it is scrutinised and reduced.
• Coverage concentrated on large companies. An analyst's time is finite, and a research provider allocates it where the revenue is. Large companies with many potential clients generate more research revenue than small ones.
• Small and mid-cap coverage fell, in some cases to zero.
• Uncovered companies became harder to invest in. An institutional investor with limited internal capacity relies partly on external research. A company nobody covers is a company most institutions cannot efficiently assess.

Why this matters for the sequence's central problem. As the 2015 and 2019 reports describe, Europe's structural weakness is the exit route: thin public markets producing lower achievable valuations and therefore lower returns, which justifies lower institutional allocation to venture.

Reduced small-cap research coverage makes that worse. A company listing at small scale in a market where nobody will cover it faces thinner trading, less institutional participation and a lower valuation. That reduces the attractiveness of listing, which reduces the exit route's value, which feeds directly back into the equilibrium the 2015 report describes.

The general lesson is about second-order effects in market structure. A rule aimed at transparency in one part of the market changed the economics of research provision, which changed coverage, which changed the viability of small-cap listing. None of that was the target and all of it followed predictably from the cost structure.

What an allocator could act on

Model compliance cost as a fixed cost when assessing early-stage companies in regulated categories. It does not scale with size, which means it consumes a disproportionate share of a small company's capital and is a durable advantage for whoever has already paid it.

Expect concentration to increase in newly-regulated categories, not decrease. The cost structure produces it regardless of intent, and the effect is observable across jurisdictions and sectors.

Add a data-basis diligence category. Not what data a company holds but on what lawful basis, for what purposes, and with what cross-border transfer mechanism. A model dependent on data whose basis cannot be demonstrated is a model that may not survive scrutiny.

Check research coverage before assuming a listing route. A company listing into a market where it will attract no analyst coverage faces thinner trading and a lower valuation. For a European growth company, this materially affects whether listing is a realistic exit and at what price.

Watch for second-order effects in market structure rules. The research unbundling case is a clean example: a transparency rule changed research economics, which changed coverage, which changed small-cap listing viability. The effects that matter are frequently two steps from the rule's target.

Recognise the asymmetry in Europe's position. Its demand side is integrated enough to set global standards; its supply side is fragmented enough to struggle to scale companies. An investor assessing Europe should price both, and they point in opposite directions.

The trade-off nobody stated

A tension ran through 2018's regulatory developments that was not acknowledged at the time and became explicit policy debate six years later.

The two objectives, both legitimate:

• Protection. Establish rights over personal data, transparency in financial markets, and constraints on dominant firms. These have real value that no competitive-effects analysis captures.
• Company formation. Produce large, globally competitive technology companies, which requires an environment where new entrants can grow.

Why they conflict at the margin, through the mechanisms this report describes:

• Compliance is a fixed cost, so it consumes a larger share of a small company's resources than a large one's.
• Data restrictions constrain the models that data-rich adjacency strategies rely on — which is the growth path many platform businesses used.
• Reduced small-cap coverage makes the public exit route less viable, which reduces the return that justifies funding growth in the first place.

None of these is decisive individually. Together they tilt the environment toward incumbents and away from entrants, which is the opposite of what a competition-focused policy intends.

The honest framing is that this is a trade-off, not a mistake. A jurisdiction can prioritise protection and accept a cost in company formation, or prioritise formation and accept a cost in protection. Both are defensible political choices. What is not defensible is claiming both without acknowledging the tension, which was largely the position in 2018.

For an investor the practical consequence is that the trade-off's resolution is a policy variable worth tracking, because it determines the environment European companies operate in. The Europe Investment Report 2024 describes it becoming an explicit policy frame — at which point it stopped being an unstated side effect and started being a decision that could go either way.

What 2018 established for Europe

• Rulemaking was established as Europe's effective global instrument, transmitted through cost asymmetry rather than through legal reach.
• The strictest large market sets the global standard, because selective compliance costs more than universal compliance.
• Compliance cost was shown to be a fixed cost, advantaging incumbents and raising barriers to entry in the categories rules were meant to open.
• Data was reframed from asset to liability, adding a diligence category that no financial statement captures.
• Research unbundling reduced small-cap coverage, worsening the exit-route problem at the centre of Europe's venture equilibrium.