The passport is a notification mechanism. A firm authorised in one member state tells its home regulator which services it intends to provide in another, the home regulator forwards that notification, and after a short waiting period the firm may operate. There is no second application, no second capital requirement and no second licence. What there is, in every single host state, is a body of local rules the firm now has to comply with.
Home rules and host rules split unevenly
Prudential supervision stays with the home regulator: capital, own funds, governance, systems and controls, reporting. Conduct in the host market is where it splits. Marketing communications, complaints handling, language requirements and a range of consumer protection provisions are host state matters, and they differ substantially between member states even under a maximum harmonisation directive.
The split also depends on how you enter. Providing services cross-border from the home state keeps most conduct supervision with the home regulator. Establishing a branch moves conduct supervision for that branch's business to the host regulator. Firms often pick the services route because it is administratively lighter and then behave as though they had a branch, with local staff and a local address, which invites the host authority to take the view that a branch exists in substance.
A local phone number, a local office, staff resident in the country and locally contracted salespeople are the facts a supervisor looks at. If the substance says branch, describing it as cross-border services in your notification does not settle the question.
National measures the passport does not override
Several member states have used product intervention powers to impose restrictions that go beyond the EU baseline. Leverage caps, marketing bans, restrictions on specific instruments and bonus prohibitions are applied at national level and bind any firm serving clients in that country, whether it is locally authorised or passported in. The leverage cap framework is the widely known example, and several countries have gone further than the EU-wide floor.
Marketing restrictions are the most active area. Some countries prohibit unsolicited electronic promotion of leveraged products, some require specific risk warnings in a prescribed format and font, some require prior approval or filing of promotional material, and some restrict advertising channels entirely. Getting this wrong is the most common enforcement trigger for passported firms, because marketing is visible and easy for a supervisor to sample. The article on CFD marketing restrictions goes through the categories in more detail.
Language is a real obligation
Client-facing documentation frequently has to be provided in an official language of the host state. That covers the terms of business, key information documents, risk warnings and often the complaints procedure. A firm passporting into six countries is committing to maintain accurate translations in six languages, updated every time a document changes, with the legal exposure of a mistranslated risk warning sitting with the firm.
Support is a related trap. Where a firm sells in a local language, supervisors expect it to service and handle complaints in that language too. Selling in Italian and answering complaints only in English is the sort of asymmetry that reads badly in any review, which is why our own products treat the client portal language as a compliance surface rather than a marketing nicety.
Where the passport ends entirely
The passport covers the EEA. It does not reach the United Kingdom, which left the framework, and it does not reach Switzerland. A firm serving UK clients needs UK permissions or has to rely on a narrow overseas regime, and the same applies in reverse. The post-Brexit position is a separate analysis for any firm that had a UK book before the split.
The passport also covers only the services and instruments in your authorisation. A firm with permission to receive and transmit orders cannot passport dealing on own account, because it does not hold that permission at home. Extending the product range means varying the home authorisation first and renotifying, and the renotification is often forgotten, leaving a firm offering instruments in a host state that its notification never mentioned.
Third country firms and reverse solicitation
Non-EU firms have no passport. They may serve EU clients only through a local authorisation, an established branch under the third country regime, or on the narrow basis that the client approached them entirely on their own initiative. That last route is the most abused idea in the industry. It attaches to a single client and a single service, it is destroyed by any marketing that reached the client, and it does not extend to further products offered later.
Supervisors have said repeatedly that online advertising visible in a member state, local language websites and affiliate campaigns targeting local traders all defeat the claim. A firm running paid acquisition in a country and then arguing that arriving clients solicited it is making an argument the regulator has already published a view on. The pieces on reverse solicitation and third country firms set out where the line sits.
What to do before you notify
Treat each host state as a separate compliance project even though it is a single legal permission. Read the national product intervention measures, the marketing rules, the language requirements and the complaints and ombudsman arrangements. Price the translation and local support cost into the plan. Decide honestly whether you are providing services or establishing a branch, and document why.
This is a description of the framework, not legal advice. National implementations differ, national measures change, and any firm planning cross-border distribution should take advice in each target market before it starts.
"Firms read the passport as permission to ignore the host country. It is permission to enter it. Those are not the same document."
— Roman Onta, Executive Director, SINGUARD
Key Takeaways
- A passport removes the need for a second licence but does not remove host state conduct, marketing, language and complaints obligations.
- Services and branch passports split supervision differently, and local staff or a local office can make a branch exist in substance whatever the notification says.
- National product intervention measures such as leverage caps and marketing bans bind passported firms exactly as they bind local ones.
- The passport covers only the services in your home authorisation and stops at the EEA border, so the UK and Switzerland need separate permissions.
Frequently Asked Questions
Does an EU passport mean the same rules apply in every country?
No. Prudential supervision stays with the home regulator, but conduct matters such as marketing communications, language requirements and complaints handling are host state responsibilities and differ between member states. Several countries also apply national product intervention measures that go beyond the EU baseline.
What is the difference between a services passport and a branch passport?
A services passport covers provision from the home state, with most conduct supervision remaining at home. A branch passport establishes a local presence and moves conduct supervision of that branch's business to the host regulator. Local staff and a local office can make a supervisor treat an arrangement as a branch in substance.
Can a non-EU broker rely on reverse solicitation?
Only in narrow circumstances. The exemption applies where a specific client approached the firm entirely on their own initiative, and it is defeated by marketing that reached that client, including online advertising visible in the member state and local language websites. It does not extend to further products offered afterwards.
About the Author
Roman Onta is an Executive Director at SINGUARD. He builds the Prop Firm CRM, the Broker CRM, Scalegram and CopySignals side by side with his brother Alex Onta, and he helped on the design of eTrader, the division Alex built and leads. His ground is worldwide payment processing, AML compliance and the corporate structures brokers are built on, work the two of them carry together, shaped by executive roles in the UAE and international corporates. He lives and works in Dubai for most of the year. Meet the executive duo leading Singuard's five divisions.