Before 2021 a firm authorised in London could passport its investment services into any EEA state on a notification, and a firm authorised in Cyprus or Ireland could do the reverse. That reciprocity ended at once. The UK onshored the EU rulebook into domestic law so that day one looked almost identical in substance, which is why some firms wrongly concluded nothing had happened. What changed on day one was market access, not rule content. Rule content has been changing ever since.
The access problem
An EU firm wanting UK retail clients now needs UK authorisation or a route into the UK's third country framework. A UK firm wanting EU clients needs an EU authorised entity, which in practice means an operating licence in one member state with passporting from there. The temporary permissions regime bridged the gap for incoming EEA firms for a few years and then closed, moving firms into a supervised run-off or into full authorisation.
The UK does have the overseas persons exclusion, a long standing carve-out that lets certain non-UK firms deal with UK counterparties without authorisation in defined circumstances. It is narrower than most sales teams hope and is not a retail marketing permission. The EU equivalent conversation is reverse solicitation, and the same warning applies on both sides: it describes a client approaching a firm entirely on their own initiative, and a single targeted advertisement destroys the argument for every client who saw it.
Where the rulebooks have actually diverged
The product intervention measures on CFDs came across into UK law and remain broadly aligned with the EU package, so leverage caps, negative balance protection and the incentive ban look similar on both sides. Divergence is happening in other places, and it is cumulative rather than dramatic.
The Consumer Duty is the largest UK specific addition. It sets an outcomes based standard requiring firms to act to deliver good outcomes for retail customers, running across products, price and value, consumer understanding and support. It is not a rule you satisfy with a disclosure. It requires firms to evidence outcomes and to monitor for groups of customers receiving poor ones, which is a data and governance obligation that has no direct EU twin.
Prudential rules split as well. The UK introduced its own investment firm prudential regime while the EU applied its own package, and while both derive from the same origin, the capital, liquidity and reporting details have moved apart. Any group calculating group capital across both entities is running two calculations. That belongs in the same planning as the wider capital requirements question.
There is no general equivalence decision covering investment services between the UK and the EU, and firms should not plan around one arriving. The workable structures are authorisation on both sides, a single side with genuinely restricted access to the other, or a group arrangement where each entity serves the clients it is permitted to serve and can prove it.
The operational consequences of two entities
Running a UK entity and an EU entity is not a legal formality. It is two authorisations, two compliance functions, two sets of regulatory reporting, two client asset regimes and two complaint routes with different ombudsman schemes. Client onboarding has to route the applicant to the correct entity by residence and evidence that decision, because supervisors ask to see how a French resident ended up with a contract against the UK entity.
Reporting is the quiet cost. Transaction reporting continues on both sides with separate regimes and separate approved reporting mechanisms, and the UK has been consulting on simplifying its version while the EU develops its own. The two are diverging on fields, timing and identifiers, so a single reporting pipeline needs a jurisdiction switch rather than a shared configuration. The same applies to marketing approvals, financial promotions rules and the risk warning text on landing pages.
Data adds another layer. UK GDPR and EU GDPR are separate instruments with an adequacy arrangement that is periodically reviewed, so a group moving client files between entities needs a transfer basis that survives review rather than an assumption. Firms handling this properly treat it as part of their data protection obligations rather than an IT question.
Client agreements need attention too. A contract written for a passporting world often names the wrong entity, points at the wrong dispute route and cites rules that no longer apply to half the client base. Firms that split entities without rewriting the terms end up with UK clients contracting under EU documentation, which is the kind of finding that turns a routine supervisory visit into a remediation project.
How to think about it when choosing a base
For a new firm the choice is driven by where the clients are, not by which regulator has the better reputation. UK authorisation is the right answer for a firm whose market is UK retail and institutional. An EU licence is the right answer for a firm targeting the single market, and Cyprus, Malta and Ireland remain the common entry points, which is what the FCA against CySEC comparison covers in detail. Doing both from day one is expensive and rarely justified before there is revenue on both sides.
The thing to avoid is the structure where a firm holds one licence and quietly serves clients from the other bloc on the assumption that nobody will look. Both regulators have been explicit about unauthorised cross-border solicitation and both publish warning lists. That risk sits on the founders personally in a way most other operational risks do not.
"Most groups solved Brexit with two entities and told themselves it was temporary. Six years later the two rulebooks have drifted far enough apart that the second entity is not a duplicate any more, it is a different business."
— Roman Onta, Executive Director, SINGUARD
Key Takeaways
- Passporting ended in both directions on 31 December 2020, so market access now requires authorisation on each side rather than a notification.
- The UK onshored the EU rulebook, which made day one look identical, and divergence since has come from UK additions such as the Consumer Duty and separate prudential and reporting regimes.
- The overseas persons exclusion and reverse solicitation are narrow carve-outs describing client initiated contact, not marketing permissions for either bloc.
- Two entities means two compliance functions, two reporting pipelines, two client asset regimes and two complaint routes, and onboarding must evidence which entity each client belongs to.
Frequently Asked Questions
Can an EU broker still serve UK clients after Brexit?
Not on the basis of its EU licence alone. Passporting into the UK ended, the temporary permissions regime closed, and firms now need UK authorisation or must fit within a narrow third country route that does not support retail marketing.
Did UK leverage limits change after Brexit?
The CFD product intervention measures were onshored into UK law and remain broadly aligned with the EU package, including leverage caps, the margin close-out rule and negative balance protection for retail clients.
What is the Consumer Duty?
It is a UK specific outcomes based standard requiring firms to act to deliver good outcomes for retail customers across product design, price and value, consumer understanding and customer support, with evidence and ongoing monitoring rather than disclosure alone.
About the Author
Roman Onta is an Executive Director at SINGUARD. He builds the Prop Firm CRM, the Broker CRM, Scalegram and CopySignals side by side with his brother Alex Onta, and he helped on the design of eTrader, the division Alex built and leads. His ground is worldwide payment processing, AML compliance and the corporate structures brokers are built on, work the two of them carry together, shaped by executive roles in the UAE and international corporates. He lives and works in Dubai for most of the year. Meet the executive duo leading Singuard's five divisions.