How EU fund rules leave gaps in investor protection