The End of Passporting
From 1 January 2021, UK-authorised financial services firms lost the ability to "passport" their services into EU/EEA member states. Under the pre-Brexit framework, a firm authorised in one EEA state could provide services across all 30 EEA states without obtaining separate authorisations: either through establishment of a branch (freedom of establishment) or on a services basis (freedom of services).
The loss of passporting affects all categories of regulated firms, including payment institutions, electronic money institutions, investment firms, banks, insurance companies and fund managers. This guide examines the options available to UK firms that wish to continue serving EU/EEA customers. The short answer: for any sustained EU business, set up an authorised subsidiary in one EEA state and passport from there; equivalence and reverse solicitation cover only narrow cases.
Option 1: Establish an EU/EEA Subsidiary
The most common, and most reliable, route for UK firms to access EU markets is establishing a separately authorised subsidiary in an EU/EEA member state. Once authorised in one member state, the subsidiary can passport its services across the entire EEA.
Choosing a jurisdiction:
The choice of jurisdiction depends on several factors including regulatory approach, speed of authorisation, language, tax regime and operational costs. Popular choices include:
Lithuania: - The Bank of Lithuania has actively positioned itself as a gateway for fintech firms seeking EU access - A 3-month statutory decision period for complete EMI and PI applications - An established route for crypto firms through a Lithuanian MiCA CASP licence - Lower operational costs than Western European alternatives - English is widely used in regulatory engagement - Minimum capital requirements align with EU minimums
Ireland: - The Central Bank of Ireland is one of the most experienced EU regulators - English-speaking jurisdiction with common-law legal tradition - Strong regulatory reputation that facilitates passporting acceptance across the EEA - Higher operational costs and more intensive supervisory approach than some alternatives - Significant substance requirements: Ireland expects genuine local operations, not "brass plate" entities
The Netherlands: - De Nederlandsche Bank (DNB) is a well-respected regulator - Strategic location with strong financial services infrastructure - English is widely spoken in business contexts - Moderate operational costs - Strong fintech ecosystem
Substance requirements: All EU regulators require subsidiaries to have genuine local substance, not merely a registered office and a compliance officer. Minimum expectations typically include: - Local directors with genuine decision-making authority - Adequate local staffing (compliance, risk, operations) - IT infrastructure accessible from the local jurisdiction - Local board meetings and governance - Local bank accounts and financial infrastructure
EU supervisory authorities, including the EBA and ESMA, have published opinions against "letter-box" entities and expect national regulators to check that applicants have genuine substance and are not choosing a home state only to passport elsewhere.
Crypto firms: Under MiCA, a crypto-asset service provider authorised in one member state can passport across the EU. See our guide to the EU MiCA CASP licence.
Option 2: Equivalence Decisions
The EU's regulatory framework includes provisions for the European Commission to grant "equivalence" to third-country regulatory regimes. An equivalence decision allows firms from the third country to provide specific services into the EU without establishing a local presence: subject to conditions.
Current status of UK equivalence: The European Commission has granted only limited equivalence to the UK. The main live decision covers UK central counterparties (CCPs), which the Commission has extended several times, most recently to 30 June 2028. Temporary equivalence for UK central securities depositories expired in June 2021.
Broad equivalence decisions covering investment services, banking or payment services have not been granted and remain politically uncertain. The EU has indicated it prefers to develop its own financial services capacity ("strategic autonomy") rather than granting wide-ranging equivalence to the UK.
Implications: Equivalence is not a reliable strategy for market access. Decisions can be withdrawn by the Commission, are time-limited, are subject to political considerations and do not cover most regulated activities. Firms that rely solely on equivalence expose themselves to significant regulatory and commercial risk.
Option 3: Reverse Solicitation
Under MiFID II (Article 42) and equivalent provisions in other EU directives, an EU customer may access services from a third-country firm at their own exclusive initiative: without the firm needing EU authorisation. This is known as "reverse solicitation."
Conditions for reverse solicitation: - The customer must initiate the contact: the firm must not have solicited the customer through marketing, advertising or outreach - Each transaction must be genuinely initiated by the customer: a single instance of reverse solicitation does not create a blanket permission for all future business with that customer - The firm must not market or advertise its services in the EU
Regulatory scrutiny: EU regulators, particularly ESMA and national competent authorities, scrutinise reliance on reverse solicitation closely. ESMA's statements, and its 2024 guidelines on reverse solicitation under MiCA, make clear that: - Maintaining a website accessible from the EU does not automatically constitute solicitation, but websites specifically designed to attract EU customers (e.g., EU-specific pricing, EU language options, EU regulatory disclaimers) may undermine a reverse solicitation claim - Attending conferences, publishing thought leadership or maintaining an EU social media presence may be considered solicitation depending on the context - Firms that generate a significant proportion of revenue from EU customers through purported reverse solicitation face heightened scrutiny
Practical limitations: Reverse solicitation is a narrow exception, not a business strategy. It may be appropriate for occasional, genuinely client-initiated transactions but cannot sustain a systematic EU business. Firms relying on reverse solicitation should maintain comprehensive records demonstrating that each client relationship was initiated by the customer.
Option 4: Contractual and Outsourcing Arrangements
Some UK firms have explored arrangements where an EU-authorised entity acts as the regulated "front end" for EU customers, while the UK firm provides outsourced services (portfolio management, technology, compliance support) under an outsourcing agreement.
This model can work but is subject to significant constraints: - The EU entity must have genuine decision-making authority: it cannot be a "letter box" that rubber-stamps decisions made in London - Outsourcing arrangements must comply with the relevant EU outsourcing guidelines (EBA, ESMA or EIOPA depending on the sector) - Critical or important functions outsourced to a third-country entity are subject to enhanced oversight requirements - National regulators may impose additional conditions on outsourcing to UK firms, reflecting the loss of the EU supervisory framework
The UK's Position: Overseas Persons Exemption
While this guide focuses on UK firms accessing EU markets, it is worth noting the UK's approach to inbound access. The UK keeps an "Overseas Persons Exclusion" (OPE) in the RAO that allows certain non-UK firms to deal with UK clients without FCA authorisation, subject to conditions. HM Treasury has reviewed the UK's overseas framework, so overseas firms should check the current position before relying on the OPE.
Strategic Considerations
Timeline and cost: Timelines depend on the licence and the regulator's statutory periods: for example, 3 months from a complete EMI or PI application in Lithuania, and 6 months from a complete bank application. Firms should budget for: - Professional fees: we quote a fixed fee once the scope is confirmed - Local staffing and office costs: these vary by jurisdiction - Regulatory capital: depends on the authorisation type (from €20,000 for some payment institutions to €350,000 for EMIs and €5 million for banks) - Ongoing compliance and supervision costs
Regulatory arbitrage risks: The EBA and national regulators are vigilant against firms that seek authorisation in the most permissive jurisdiction with the intention of passporting into jurisdictions with higher standards. Firms should choose a jurisdiction based on genuine operational and commercial factors, not merely the speed or ease of authorisation.
Future developments: UK-EU financial services cooperation remains subject to political negotiation. The Memorandum of Understanding on financial services regulatory cooperation, signed in June 2023, provides a framework for dialogue but does not give market access. For banks, CRD VI will require third-country firms providing core banking services into an EU state to use a local branch from 11 January 2027, subject to limited exemptions. Firms should plan on the basis that access will continue to depend on EU authorisation.
Practical Recommendations
Assess your EU revenue and client base. If EU revenue is material, establish a properly authorised subsidiary. If EU revenue is minimal or incidental, reverse solicitation may be sufficient in the short term, but monitor regulatory developments closely.
Choose your jurisdiction carefully. Consider not just speed of authorisation but long-term supervisory relationship, substance requirements, tax implications and the jurisdiction's reputation across the EEA.
Build genuine substance. Whatever jurisdiction you choose, invest in genuine local presence. Regulators across the EU are increasingly rigorous in assessing substance, and a "brass plate" entity creates long-term supervisory and reputational risk.
Maintain flexibility. The post-Brexit regulatory landscape continues to evolve. Build your EU structure with sufficient flexibility to adapt to new equivalence decisions, regulatory changes or shifts in your EU business strategy.
Frequently asked questions
Not on the basis of UK authorisation alone. UK firms lost EU passporting rights when the Brexit transition period ended on 31 December 2020. To serve EU customers, firms must either establish an authorised subsidiary in an EU/EEA member state, rely on limited equivalence decisions (where available) or ensure each client relationship falls within the narrow reverse solicitation exemption.
There is no single best jurisdiction: the choice depends on your business model, target markets, operational requirements and budget. Lithuania offers short statutory timelines, lower costs and an established MiCA route for crypto firms; Ireland provides a common-law, English-speaking environment with strong regulatory reputation; the Netherlands offers a central location and respected regulator. Each has different substance requirements and supervisory approaches.
No. Reverse solicitation is a narrow legal exemption for genuinely client-initiated business, not a substitute for proper market access. EU regulators are increasingly scrutinising firms that generate significant EU revenue through purported reverse solicitation. For any firm with a strategic interest in EU markets, establishing an authorised subsidiary is the only reliable long-term approach.
Not on the basis of UK registration or authorisation. It needs a MiCA licence as a crypto-asset service provider in one EU member state, which can then be passported across the EU. Lithuania is one established route.
It depends on the licence. In Lithuania, for example, the regulator must decide a complete EMI or PI application within 3 months and a complete bank application within 6 months. Preparing a complete application and building local substance come first.
Definitive guides on this topic
The permanent reference pages this article relates to.