EU Passporting: One License, Many Markets.

A firm authorised in Cyprus can take a client in Portugal without a Portuguese licence. That single mechanism explains why so many retail brokers concentrated in a handful of member states, and why a licence in one of those states costs so much more than an equivalent permission offshore. The passport is the product.

It is also narrower than the marketing suggests. Under MiFID II an authorised investment firm may exercise the freedom to provide services and the freedom of establishment across the European Economic Area, but only for the services and instruments its home authorisation actually covers, and only within the conduct expectations of each host state.

Two passports, not one

The services passport covers cross border activity performed from the home state. There is no office abroad, no local staff, and the notification file is short: the member states you intend to serve, the investment services and activities you will provide, and the instruments involved. The home regulator forwards it to each host authority and the firm may start once the process completes.

The branch passport covers a physical establishment. It requires a programme of operations, an address, a named branch manager, an organisational chart and a description of how the branch will be supervised. The regulator has a longer assessment window, and once the branch exists the host authority supervises how it conducts business locally while the home authority keeps prudential oversight.

Choosing between them is usually a commercial question first. A branch gives local credibility, local hiring and sometimes local payment access. It also gives a second set of inspectors, local employment obligations and a fixed cost that a services passport avoids. For a firm testing a market, the services passport is almost always the right start.

What the home regulator is really assessing

Regulators have become far less willing to treat a passport notification as an administrative formality. If a firm authorised in a small member state notifies twenty host states while employing a handful of people domestically, the supervisor asks the obvious question about substance: who is servicing those clients, in which language, with what complaint handling, and what happens when volumes triple.

That scrutiny grew out of a period when letterbox entities passported aggressively into large markets and left their host authorities dealing with the complaints. The authorisation process itself, and the substance expectations behind it, are covered in our CySEC licence walkthrough and in the broader MiFID II overview.

Where host state rules bite

Prudential matters stay with the home regulator: capital, systems and controls, reporting. Conduct is where the host state keeps a grip. Marketing communications generally must meet local expectations, disclosures often have to be in the local language, complaint handling must point to the appropriate local scheme, and national product intervention measures apply to clients in that state regardless of where the firm is licensed.

That last point matters for leveraged products. Several member states have used their intervention powers to set restrictions that go beyond the pan European baseline, and those restrictions follow the client, not the licence. A firm passporting into such a state must apply the local limit to those clients. The pattern is described in our piece on European leverage caps.

The reverse solicitation trap

Firms without a passport sometimes rely on the idea that the client approached them, so no cross border service was provided. The concept exists, and it is genuinely narrow. Regulators have repeatedly said that any form of solicitation, including advertising, targeted content, affiliate campaigns or a sign up flow that accepts residents of that state, defeats the argument.

Where it goes wrong is affiliates. A firm can be scrupulous in its own marketing while paying partners who run local language ads into a state the firm never notified. The regulator does not treat that as somebody else's behaviour. If you use partners, contract for it and monitor it. We look at the doctrine in more detail in the reverse solicitation guide, and at what non EEA firms can do in the third country firms piece.

Practical sequencing for a new firm

Get the home authorisation scoped correctly, including the instruments you plan to add in year two rather than only the ones you launch with. Notify the states where you have a genuine plan, not the full list, because every notified state is a state whose local rules you have promised to follow and whose regulator may write to you. Build the language and disclosure work into the product before the notification, since a host authority reading a Spanish landing page written in English draws its own conclusions.

Then maintain it. Passports have to be updated when permissions change or when a branch closes, and stale notifications are a common finding in reviews. Keep a register of which state you notified, on which date, for which services, and who inside the firm owns each host relationship. It is a spreadsheet job that saves a supervisory headache.

One thing the passport never does: it does not give you banking. Account opening, payment acquiring and settlement all remain commercial negotiations with institutions that will look at your client base and your dispute history rather than at your notification list.

"Firms treat the passport as a list of countries to tick. It is a list of regulators who now expect you to answer their letters in their language. Notify the markets you will actually serve."

— Roman Onta, Executive Director, SINGUARD

Frequently Asked Questions