A firm registered in St Vincent runs a Spanish creative, targets postcodes around Madrid, publishes a page at /es with EUR pricing and a SEPA deposit button, and pays a Barcelona affiliate on revenue share. Somebody in the compliance chat asks whether this is allowed. The answer they usually get is that the licence is offshore, so EU rules do not apply. That answer has the logic backwards.
The test is solicitation, not incorporation
European investment services law attaches to activity carried out in a member state, and marketing is activity. A firm without an authorisation in the Union, and without an equivalence arrangement covering the relevant service, is a third country firm. When such a firm actively promotes investment services to residents of France, Germany or Poland, the supervisor in that state can treat the promotion as the provision of unauthorised services on its territory. The registered office in Kingstown does not change the analysis. Neither does a T&C clause saying the firm does not target the EU, if the advertising spend says otherwise.
This is why the perimeter question rarely arrives as a debate about the licence itself. It arrives as a public warning notice naming a website, or as a request from a national regulator to an ad platform. The document that gets quoted back at the firm is usually a screenshot of its own funnel. If you want the fuller picture of what an EU authorisation actually buys, passporting is the mechanism worth understanding first, because it is the thing an offshore structure is trying to avoid paying for.
Reverse solicitation is narrower than the sales team believes
There is a genuine exemption. Where an EU client approaches a third country firm entirely on their own exclusive initiative, the firm may provide the service the client asked for without an EU authorisation. That is the whole of it. ESMA has said more than once that the exemption should be read narrowly and that it cannot be created by wording. A checkbox saying "I confirm I contacted this broker on my own initiative" is evidence of nothing if the click that produced the signup came from a paid ad.
Two details get missed. First, the exemption is scoped to the product the client asked about. It does not open the door to marketing a different instrument class to the same client afterwards. Second, the exemption is a defence about one relationship, not a business model. A firm with tens of thousands of EU clients and a media buying team cannot claim that every one of them arrived unprompted.
None of this is legal advice, and the analysis is national. Two member states can read the same funnel differently, and the practical exposure sits with the operating firm, not with any vendor supplying its software.
What a supervisor reads off your website
Perimeter cases are built from public evidence. These are the signals that come up again and again, and what each one is taken to mean.
| Signal | How it reads |
|---|---|
| Language versions for member state languages | Deliberate targeting of that population, unless the language is also spoken in your licensed markets |
| EU country selector on the signup form | Acceptance of residents from that state as a normal part of onboarding |
| SEPA deposits, EUR base currency, local card acquiring | Payment infrastructure built for EU retail clients |
| Paid ads without EU exclusions in the ad platform | Active promotion, the strongest single item in a case file |
| Affiliates or finfluencers publishing in the local language | Marketing carried out on the firm's behalf |
| Local support numbers or a member state office | An establishment argument on top of the marketing one |
Note what is absent from that list: the leverage on offer, the spread, the quality of the platform. A firm can run an honest book with fair pricing and still be squarely outside the perimeter. The perimeter is about permission, not conduct. Conduct rules such as the ESMA leverage caps and the restrictions on CFD advertising only bind once you are inside it, which is the irony offshore firms keep running into: they avoid the conduct rules by taking a position that exposes them to a harder problem.
Affiliates are your marketing, whatever the contract says
The most common failure I see is not a firm deciding to target Germany. It is a firm deciding not to, then paying for traffic it never inspected. An affiliate network sends volume. Nobody asks which countries the creatives run in. Six months later a German-language YouTube review with a tracking link is sitting in a supervisor's file, and the tracking link resolves to the broker's own domain with the affiliate's ID attached.
Firms that take this seriously do three things at contract level. They write a country whitelist into the affiliate agreement rather than a blacklist, because a whitelist fails closed. They require creative approval before a campaign runs. They enforce the whitelist technically, by rejecting registrations whose IP and document country fall outside it even when the affiliate link is valid, which means the check belongs in the CRM and not only in a PDF.
The split that actually holds
An offshore entity serving non-EU markets is a legitimate structure used by plenty of firms. What makes it hold is consistency between what the paperwork says and what the systems do. Restricted countries enforced at registration, not at the withdrawal stage. IP country and document country both checked, with a mismatch queued for review rather than auto-approved. Ad platform geo exclusions set at the account level so a junior media buyer cannot undo them. Payment methods that match the licensed footprint. An audit trail showing when each control was turned on.
The alternative path is to stop fighting the perimeter and enter it, which means an authorisation in a member state and the capital, reporting and conduct obligations that come with it. That is a real cost and it is fair to weigh it against the revenue from EU retail. What does not work is the middle position: taking EU deposits at offshore scale while claiming every client walked in alone. Anyone comparing structures should read how the offshore licences differ before assuming they are interchangeable, because supervision quality varies widely and so does the reputational cost when a warning notice lands.
"If your ad spend map and your restricted country list disagree, the ad spend map is the one a regulator will believe."
— Roman Onta, Executive Director, SINGUARD
Key Takeaways
- EU investment services rules attach to where marketing is aimed, not to where the licence was issued.
- Reverse solicitation covers one client who arrived unprompted and one product. It is not a business model.
- Localised pages, EUR pricing, SEPA rails and local-language affiliates are all read as deliberate targeting.
- Country restrictions only count when they are enforced at registration in the system, not written in the terms.
Frequently Asked Questions
Can an offshore broker legally accept EU clients?
It depends on how the client arrived. EU law is built around solicitation, not incorporation. If a firm without an EU authorisation promoted itself to residents of a member state, ran ads there, hired local affiliates or built a localised funnel, the national supervisor can treat the activity as unauthorised investment services in that state regardless of where the licence was issued. A client who genuinely found the firm on their own initiative sits in a much narrower exemption.
What is reverse solicitation and why do regulators dislike it?
Reverse solicitation is the exemption that lets a third country firm serve an EU client who approached it entirely on their own initiative. ESMA has repeatedly said the exemption is meant to be narrow and cannot be manufactured by a tick box at signup. Any promotion aimed at that client, including ads, sponsored posts, affiliate links and localised landing pages, undermines the claim for that category of product.
Do affiliates and influencers count as the broker's own marketing?
In practice yes. If an affiliate is paid by the broker for traffic or revenue share, a supervisor will read the affiliate's content as marketing carried out on the broker's behalf. That is why offshore firms serious about staying out of EU perimeter disputes put country whitelists into affiliate contracts, review creative before it runs, and terminate partners who target restricted states.