A brokerage authorised by the DFSA takes an account application from a resident of the Netherlands. Nothing in the Dubai rulebook stops it. Whether anything in EU law stops it depends on the client's classification, on who made the first approach, on whether the firm has an establishment inside the bloc, and on which Member State the client actually lives in.
"Third-country firm" is the MiFID II term for an investment firm whose head office sits outside the European Union. The rules for reaching EU clients are split between MiFID II and MiFIR, and the split runs along client type rather than geography. Get that wrong and every downstream decision, from the sales script to the payment provider, is built on sand.
The client classification decides which regime applies
Retail clients and elective professional clients fall under Article 39 of MiFID II. It hands each Member State an option: require a third-country firm to establish a branch in that state before it may provide investment services to those clients, or leave the question to national law. Several of the larger markets exercised the option. Others did not, but still apply domestic solicitation and promotion rules that reach the same practical outcome. There is no single EU answer here, which is why any competent legal opinion on this arrives as a country-by-country table rather than a paragraph.
Per se professional clients and eligible counterparties are handled by Articles 46 to 49 of MiFIR. A firm whose home jurisdiction has an equivalence decision from the European Commission can register with ESMA and then serve those categories across all Member States without any local establishment. That is a real cross-border permission, and it is the closest thing to a passport a non-EU firm can hold. It also excludes every retail client, which for most CFD brokers removes ninety-something percent of the target market.
| Route | Who you may serve | Territory covered |
|---|---|---|
| Article 39 branch | Retail, elective professional, professional | The authorising Member State only |
| MiFIR Article 46 registration | Per se professional, eligible counterparty | All Member States |
| Article 42 reverse solicitation | Whoever approached you, for what they asked for | Case by case, never a strategy |
The branch route does not passport
Article 39 branches carry real conditions. The firm must be authorised and supervised in its home state for the services it wants to offer in the EU. A cooperation arrangement has to exist between the home regulator and the host regulator. The branch needs its own capital endowment held inside the Member State. Management must satisfy the host's fit and proper standards. The home jurisdiction must not sit on the FATF list of high-risk jurisdictions, and it must have a tax information exchange agreement with the host state that meets the OECD standard.
What the branch does not get is reach. Authorisation from the Dutch regulator covers Dutch clients. It does not open Germany, Spain or Poland. This is the single most common misreading we see, usually from firms that have read about EU passporting and assumed the mechanism extends to third-country branches. It does not. Passporting is a right held by EU-authorised investment firms, and a branch of a foreign firm is not one of those.
Reverse solicitation is a defence, not a channel
Article 42 of MiFID II says that where a retail or elective professional client established in the EU initiates at their own exclusive initiative the provision of a service by a third-country firm, the branch requirement does not apply to that service. The recital attached to it adds the part sales teams skip: the exemption does not entitle the firm to market new categories of investment products to that client afterwards.
ESMA has publicly reminded firms what counts as solicitation, and the list is unforgiving. A web page targeting a Member State. A banner served to an EU IP address. A sponsored post. A press release. A call or message from an affiliate. Any of those and the client did not approach you at their own exclusive initiative, whatever the tick box in your onboarding flow says. We cover the marketing side of this in more detail in offshore marketing to EU clients.
The burden of proof sits with the firm. When a regulator or a court asks how a client in Milan came to open an account with a Seychelles entity, "they found us" is worth nothing without records: the referral path, the campaign data, the affiliate attribution, the first inbound message. Firms that plan to rely on Article 42 need to log all of it from day one.
What the equivalence register really delivers
The Commission has been sparing with equivalence decisions in investment services. The Investment Firms Regulation tightened the regime further: registered third-country firms report annually to ESMA on the scale and scope of what they do in the EU, ESMA can request data and can withdraw the registration, and the Commission can attach operating conditions to an equivalence decision. A registration is a supervised status, not a document you file once.
For a retail-facing CFD business the practical conclusion is short. The register does not help you. If the target client is a retail investor in the EU, the realistic paths are an authorised EU entity of your own, or a distribution agreement with one, or staying out. Firms that want the retail market usually end up authorised somewhere like Cyprus and then passporting outward, which is why the CySEC route keeps appearing in group structures that started offshore.
How the structure usually ends up looking
The common shape is two entities. An EU-authorised firm handles EEA retail business under MiFID II, with the leverage caps, negative balance protection and marketing restrictions that come with it. A separate offshore entity serves the rest of the world under different terms. The two are kept apart in ways that matter: separate websites and domains, separate terms, separate client agreements, and hard geofencing at sign-up rather than a disclaimer nobody reads.
The controls that actually hold up are boring ones. Block EEA IP addresses on the offshore funnel. Validate the residence country against the KYC document rather than the dropdown. Check the payment instrument's issuing country against the declared residence, since a Portuguese card on an "Indonesian" account is the kind of thing an auditor finds in an afternoon. Bind affiliates contractually to the same geography rules and audit their traffic, because their creatives are your solicitation.
There is a private-law tail to this as well. In several Member States, a contract concluded in breach of local licensing rules can be unenforceable against the client, and consumer protection courts tend to read those provisions generously. A firm that ignores the perimeter is not only exposed to a regulator. It may be holding client agreements it cannot rely on.
"Every offshore broker I speak to treats reverse solicitation as a growth channel. It is a defence. You only get to use it after somebody has already accused you of something, and by then your ad spend is the evidence."
— Roman Onta, Executive Director, SINGUARD
Key Takeaways
- EU access for a non-EU firm is decided by client classification: retail and elective professionals sit under MiFID II Article 39, per se professionals and eligible counterparties under MiFIR Articles 46 to 49.
- An Article 39 branch is authorised by one Member State and serves that Member State's clients. It carries no passport into the other 26.
- Reverse solicitation collapses the moment there is EU-directed advertising, affiliate traffic or outbound contact, and the firm has to prove how the client arrived.
- Geofencing that works is technical: IP blocks, residence checked against KYC documents, card issuing country matched to residence, and affiliates audited on the same rules.
Frequently Asked Questions
Can a non-EU broker accept EU retail clients?
Only where the Member State allows it. Article 39 of MiFID II lets each country require a third-country firm to establish a local branch before serving retail or elective professional clients there, and several of the larger markets apply that requirement, so the answer changes country by country.
Does the MiFIR third-country register let me serve retail clients?
No. Registration under Article 46 of MiFIR covers eligible counterparties and per se professional clients only, and it depends on the European Commission having adopted an equivalence decision for the firm's home jurisdiction.
Is reverse solicitation a workable business model?
No. It is a narrow exemption for a service the client asked for on their own initiative. Advertising, affiliate campaigns, sponsored content and outbound calls all remove it, and the firm carries the burden of proving how the relationship started.