A founder in Limassol and a founder in Frankfurt are applying for the same thing. MiFID II sets out the categories of investment services and activities across the European Union, and an investment firm is authorised by the competent authority of its home member state to provide the specific services listed in its permission. Dealing on own account, execution of orders on behalf of clients, reception and transmission of orders, and portfolio management are separate items. What you may do is the list, not the country.
The permissions decide everything else
Capital requirements under the EU prudential regime for investment firms scale with the activities permitted and the size of the business, so a firm dealing on own account against its clients carries a materially heavier requirement than one that only receives and transmits orders. Organisational requirements follow the same logic: a dealing firm needs risk management, a compliance function, internal audit arrangements proportionate to its size, conflict of interest policies, and an executive team the regulator has assessed as fit and proper. Our piece on regulatory capital for brokers covers what the money is actually there for.
On top of the authorisation sit the conduct rules. Best execution, client categorisation, appropriateness testing for complex products, client asset segregation, product governance and transaction reporting all apply from day one, and they are where supervisory attention concentrates after authorisation. The MiFID II overview goes through the obligations in order.
Where firms actually apply
Cyprus has the deepest concentration of retail contract for difference firms in Europe, a regulator with more experience of this specific business model than anyone else, a large pool of staff who have done the job before, and an ecosystem of auditors, lawyers and service providers built around it. That experience cuts both ways: CySEC has run enforcement and remediation programmes across the sector, and files are read by people who know exactly what a weak one looks like. Our CySEC guide and the Cyprus page cover the practical side.
Malta's regulator authorises investment services firms under its own category system and has the same ecosystem effect at smaller scale. Ireland's central bank authorises investment firms and has become a common landing point for groups that wanted an English-speaking common law adjacent base after the United Kingdom left the Union. Germany's BaFin, France's AMF, the Netherlands' AFM and the Nordic authorities are all perfectly available, generally slower, and generally reading fewer retail CFD files. The Baltic states were popular for a period and several of them tightened materially, which is a reminder that a jurisdiction's appetite is not a permanent feature.
Descriptive only. Authorisation outcomes depend on the specific firm, its owners, its model and its capital, and the rules change. Take advice from counsel in the member state concerned.
What passporting does and does not give you
An authorised investment firm can provide its permitted services across the European Economic Area by notifying its home regulator, which passes the notification to the host state. That is a right, and it works. What founders misread is the reach of it. The home state supervises prudential matters and the firm's authorisation; host states retain conduct powers over how services are marketed and provided on their territory, and several member states have imposed their own national restrictions on marketing complex products to retail clients. ESMA's product intervention on contracts for difference established leverage limits, negative balance protection, margin close-out and standardised risk warnings, and national authorities adopted equivalent national measures. Read how the passport actually operates and the leverage limits together, because one without the other gives a false picture.
The other misreading is that a passport substitutes for local substance. A firm authorised in one member state with no meaningful presence there, marketing hard into three others, is exactly the file that draws attention from host supervisors and, in time, from the home regulator that is being asked about it.
Who accepts an EU licence
Almost everyone, and that is the point of it. Correspondent banks recognise the regime, so account opening is a normal commercial process rather than an argument. Card acquirers still classify trading as a high risk merchant category under the card scheme rules, with chargeback monitoring and reserves, but an EU-authorised entity with segregated client money and clear disclosures is an underwriting file rather than a refusal. SEPA gives you a euro rail with predictable settlement, and IBAN discrimination is unlawful within the SEPA area even though it still happens in practice.
Liquidity providers deal with EU firms routinely. App stores publish developer rules requiring financial trading apps to come from an appropriately licensed publisher for the markets they target, and an EU authorisation with a passport notification is the evidence that satisfies them for EEA distribution. Ad platforms run financial services certification across the EU, and certification is granted against the regulator's public register, which is why the entity on the register must match the entity in the advertiser account.
The honest comparison
For a firm serving EU clients, there is no substitute. An offshore licence does not authorise the activity, the passport does not exist for it, national marketing restrictions apply anyway, and the ad and app store gates enforce it commercially long before a regulator writes. The cost is real: capital, staff, audit, reporting and a compliance function that costs money every month whether trading volume arrives or not. For a firm serving clients outside the Union, an EU licence is often the wrong tool, carrying obligations that its clients gain nothing from. Whichever you choose, the reporting, appropriateness testing and client asset records have to be produced on demand, which is what our Broker CRM is built to store. SINGUARD supplies software through SGHK Softwares Limited and holds no financial services licence anywhere.
"People shop for the friendliest EU regulator and forget that the passport takes them straight into a host regulator who did not choose them. That is where a thin authorisation gets tested."
— Alex Onta, Executive Director, SINGUARD
Key Takeaways
- MiFID II defines the same investment services everywhere in the Union, so the permission list, not the country, determines what a firm may do.
- Capital and organisational requirements scale with the activities permitted, and dealing on own account is far heavier than reception and transmission.
- The passport carries the authorisation, but host states keep conduct powers and national marketing restrictions still apply.
- For EU-resident clients there is no offshore substitute, because ad platforms and app stores enforce the perimeter commercially.
Frequently Asked Questions
Which EU country is best to license an investment firm in?
The authorisation is the same across the Union under MiFID II, so the choice comes down to the regulator's familiarity with the business model, the local talent pool, timelines and cost. Cyprus has the deepest concentration of retail CFD firms, Malta and Ireland are common alternatives, and larger member states are generally slower. The decision needs local legal advice on the specific model.
Does an EU passport let me market freely in every member state?
It lets an authorised firm provide its permitted services across the EEA after notification, but host states retain conduct powers over how services are marketed on their territory, and several have imposed national restrictions on marketing complex products to retail clients. Product intervention measures on contracts for difference apply in addition to the authorisation.
Can an offshore-licensed broker serve EU clients?
Providing investment services to EU clients is a regulated activity within the Union, and an offshore authorisation does not confer it. Beyond the legal position, ad platforms and app stores run financial services certification against regulators' registers, so distribution usually fails before any enforcement action arises.
About the Author
Alex Onta is an Executive Director at SINGUARD. He built eTrader, the terminal, the mobile apps, eTrader Broker, Copytrading, Business and Community, along with the worldwide clustered-server infrastructure it all runs on, with his brother Roman Onta helping on the design, and he leads that division today. Together with Roman he builds the Prop Firm CRM, the Broker CRM, Scalegram and CopySignals, and the two of them carry worldwide compliance, payment processing and international business structuring side by side. He lives and works in Dubai for most of the year. Meet the executive duo leading Singuard's five divisions.