Branch, passport or your own authorisation: which cross-border route is open to you

This guide is for a firm that has clients, or wants clients, in a Member State other than the one where it is authorised, or anywhere in the Union when it is authorised outside it.

It is not for a firm that has not yet settled which authorisation it needs. Answering the questions in that order produces a cross-border plan for a permission the firm may never apply for.

It is not for a firm relying on an exemption from full authorisation. A Member State may exempt small payment institutions and small electronic money issuers, under conditions and subject to registration, and an exempted undertaking does not obtain the right to operate in other Member States.1112

Cross-border rights differ by framework: PSD2 and MiFID II passporting operate across the EEA, while the MiCA and ECSPR cross-border procedures are Union arrangements.171014

An authorised payment institution or electronic money institution that wishes to operate in another Member State applies through its home competent authority, which handles the notification to the host authority.10

An authorised investment firm may provide services cross-border or establish a branch in another Member State by notifying its home competent authority, which transmits the notification to the host authority.14

A credit institution authorised in one Member State may establish branches and provide services in other Member States under the freedom of establishment and the freedom to provide services, on notification through its home authority.5

A crypto-asset service provider authorised in one Member State may provide its authorised services in other Member States after its competent authority has communicated the cross-border notification.1

An authorised crowdfunding service provider may provide services in other Member States after the cross-border notification procedure has been completed through its home competent authority.7

Where the firm is authorised today. Everything on this page follows from that one fact.

Which framework the activity sits in, because a cross-border arrangement is a property of that framework rather than a general right, and the arrangements are not the same.171014

Whether the firm intends a physical presence, because providing services cross-border and establishing a branch are separate notifications under the investment services framework.14

Whether the firm intends to work through someone else. A payment institution may provide payment services through agents that it registers with its home competent authority, and it remains responsible for their acts.9

For investment services, whether that someone else is a tied agent. A tied agent acts for one investment firm only, under the full and unconditional responsibility of that firm, is entered on a public register, and using a tied agent established in another Member State is treated as establishing a branch there.13

For a third-country bank, whether the target Member State has transposed the branch provisions. The requirement takes effect through national transposing measures, and the directive sets 11 January 2027 as the date from which Member States must apply them.3

Passporting is open only to a firm already authorised in a Member State, under the framework that governs its activity, and it is exercised through the home authority rather than negotiated with the host one.171014

A branch is not one thing. For an authorised Union credit institution it is a form of establishment inside the passport. For a third-country undertaking it is a separate authorisation: CRD VI inserts a requirement that it establish an authorised branch in a Member State, or a subsidiary, before providing core banking services there.25

That third-country branch is authorised by, and confined to, the Member State that authorises it. It is not a Union authorisation and carries no passport into other Member States, so a bank targeting several Member States is comparing several branches against one subsidiary.45

The branch requirement carries exceptions set out in the same article, including services provided at the exclusive initiative of the client and investment services and activities covered by MiFID II, so it is not a blanket ban on cross-border provision.2

Your own authorisation is the route that borrows no permission. In payments it is the only route for a firm established outside the Union, because an authorisation is granted only to a legal person established in a Member State.8

A subsidiary in banking means a full credit institution authorisation in the Member State concerned, with the head office in the same Member State as the registered office.6

The third-country branch regime sets requirements on authorisation, capital endowment, booking arrangements, governance and reporting for the branch itself.4

Whether a given Member State has transposed those provisions, and on what terms, is a national question that has to be checked for the Member State concerned, and the directive sets 11 January 2027 as the date from which Member States must apply the transposing measures.3

Assuming a permission held outside the Union travels. It does not, as the sourced statements above set out, and the assumption usually surfaces at the point where a bank or a payment partner asks for the licence reference.

Reading a branch as a lighter version of an authorisation. In banking it is its own authorisation with its own requirements, and it reaches one Member State.

Treating a distribution arrangement as a permission. The institution stays responsible for the services, and the arrangement gives the other party no permission of its own.

Relying on an exception without reading it. The exceptions are part of the rule, and establishing where the activity did not require it is a real cost in the other direction.

Planning against the Union text rather than against the national measure that carries it, which gets the timing wrong in both directions.

Write down three facts: where your firm is authorised today, the exact activity you want to perform in the target Member State, and which framework that activity sits in. Those three decide which of the routes above exists for you, and only then is comparing them worth anything.