What areas of competency can the EU not make laws on?

So I’m genuinely surprised to find that the EU can make laws regulating the pay structure of private companies throughout the Continent, with their plans to introduce laws capping bankers bonuses to 100% (or 200% with shareholder approval) of their base salary, thinking this would surely be an area that only individual states could make laws on.

Is there anything that limits the EU’s ability to make laws in a certain area? What are the areas that are “off limits” for Brussels?

I’m not sure they do have competence in this area - pay is generally off limits. As I understand it, the EU is trying to fit it within their competence to manage financial risk at a more macro level. It’ll probably end up in the ECJ eventually, if it goes ahead.

It keeps on changing with every treaty and the ECJ has through it’s case law expanded the effective and practical powers of the EU greatly. But a general rule of the thumb is that the Union and only the Union can legislate in areas of it exclusive competency and in cases of shared or complementary competency the member states can legislate only where the Union has not. Union cannot legislate where it has no powers.
This of course must be qualified that there are many exceptions, opt outs etc which makes a specific answer to “can they do this” difficult.