# EU Passporting: How a Financial Licence Works Across the EEA

> How an EU financial licence works across the EEA: services or branch, notification deadlines under PSD2, MiFID II, MiCA and CRD, and what host states impose.

Author: Gordey Bolotko — Partner, Corporate & Commercial (https://wiki.private.law/en/authors/bolotko)
Last modified: 2026-09-25T08:10:00.000Z
Canonical: https://wiki.private.law/en/eu-passporting
Publisher: wiki.private.law (https://wiki.private.law)
Version: ca0bc4fd05d352aa7b5e65700165fda78ab10c51b506876b301ab6128548fdfa
Cite as: EU Passporting: How a Financial Licence Works Across the EEA. wiki.private.law. https://wiki.private.law/en/eu-passporting. Version ca0bc4fd05d352aa7b5e65700165fda78ab10c51b506876b301ab6128548fdfa.
Topics: banking
Jurisdictions: eu, bulgaria
Functional tags: license
Product tags: license-emi-eu, license-vasp-mica, bank, investment, compliance
Semantic tags: license, license-emi-eu, license-vasp-mica, bank, investment, compliance

---

A financial licence granted in one member state of the European Economic Area can be used in all the others. This is the European passport: the legal effect that EU financial legislation gives to a home authorisation. [A payment institution's authorisation is valid in all member states](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02015L2366-20250117) and lets it provide its authorised services throughout the Union, across the border or through an establishment in the host state. MiFID II, MiCA and the Capital Requirements Directive give the same effect to the licences of investment firms, crypto-asset service providers and banks.

## What the passport is and what it gives

### One licence, one supervisor, many markets

The passport answers a practical question: how does a firm licensed in Vilnius, Sofia or Luxembourg serve a client in Madrid without a Spanish licence? It does so by notification. The firm tells its own regulator, the home authority, where it wants to operate and how; the home authority checks the file and relays it to the regulator of the host state. No second licence is issued: the host regulator receives the notification from the home authority.

The territory is the EEA: the 27 EU member states plus Iceland, Liechtenstein and Norway, so a passport reaches up to 29 host states.

Three things follow from this design. The home authority keeps prudential supervision and decides on the notification. The host state keeps a defined residue of powers, which grows once the firm has a physical presence there. And the passport belongs to the licence, not to the business model: it covers only what the home authorisation covers and rests on that licence's [capital requirements](https://wiki.private.law/en/regulatory-capital) and [vetting of owners and managers](https://wiki.private.law/en/qualifying-holding-fit-proper).

> 🍓 A passport is a notification relayed by the firm's own regulator. Its price is set by the mode chosen: serving clients from home leaves supervision where it was, while an establishment in the host state imports that state's conduct rules and, for payment firms, its AML supervisor.

### Two modes

Every passport regime offers two modes. Under the freedom to provide services the firm serves host-state clients from home, with no presence there. Under the right of establishment it sets up a branch or, in payments, works through agents located in the host state.

### Three trade-offs

The first trade-off is speed against presence. A services passport is fast: an investment firm [may start once its home authority has forwarded the notification, which it must do within one month](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02014L0065-20260606), and a crypto-asset service provider (CASP) [may start at the latest on the 15th calendar day after notifying](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02023R1114-20240109). A branch of a bank or an investment firm can take three months to be forwarded and up to two more months before it opens.

The second is that the home supervisor stays in charge, but the host is not powerless. Every regime gives the host authority emergency or precautionary powers, and in payments and investment services, branches and agents follow host rules on how services are delivered to clients.

The third is that the passport follows the licence type. [Small payment institutions (PIs)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02015L2366-20250117) and [small e-money institutions (EMIs)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02009L0110-20180113) have no passport at all; MiFID II ancillary services travel only with an investment service; [fund marketing passports follow separate rules](https://wiki.private.law/en/fund-distribution-cross-border); and nothing travels from outside the EEA, which is why a UK licence has given no access to the EU since the Brexit transition period ended on 31 December 2020.

The regime as it stands in September 2026:

- What it is · Home authorisation valid across the EEA on notification (PSD2 Art. 11(9), MiFID II Art. 34, MiCA Art. 59(7), CRD Art. 33)
- Territory · 27 EU states plus Iceland, Liechtenstein and Norway: up to 29 host states
- EEA coverage · In the EEA Agreement: [MiFID II since 3 December 2019](https://www.efta.int/eea-lex/32014l0065), [CRD since 1 January 2020](https://www.efta.int/eea-lex/32013l0036), [PSD2 since 1 May 2022](https://www.efta.int/eea-lex/32015l2366), [MiCA since 24 June 2025](https://www.efta.int/eea-lex/32023r1114)
- Modes · Freedom to provide services; right of establishment (branch, agents)
- Fastest start · MiCA: day 15 after notification at the latest
- Slowest start · Bank or investment-firm branch: up to three months plus two months
- No passport · Small PIs and EMIs; firms licensed outside the EEA, including the UK
- Pending changes · PSD3/PSR not adopted; CRD VI third-country branch rules from 11 January 2027

## Services or establishment: the line that decides supervision

The two modes lead to different supervisory results, and the line between them is drawn case by case.

**Freedom to provide services**

The firm serves host-state clients without a presence there. The home authority supervises and decides on the notification; the host receives it and keeps the emergency powers its regime grants.

**Right of establishment**

A branch, a tied agent or a payment agent in the host state. Host conduct rules apply to the establishment, host reporting can be required, and for payment firms the host's AML law and AML supervisor apply to business done through it.

### When an agent becomes an establishment

For an agent passport the home authority decides whether the agent gives rise to an establishment and, if it concludes that it does not, [must explain to the host authority the circumstances it considered](https://eur-lex.europa.eu/eli/reg_del/2017/2055/oj). The European Banking Authority's view is that [an agent located in the host state is likely, in most cases, to create an establishment](https://www.eba.europa.eu/sites/default/files/documents/10180/2622242/da05ad8a-eed2-410a-bd08-072403d086f3/EBA%20Opinion%20.pdf) if its mandate has a sufficient degree of stability. E-money distributors are assessed under the same conditions. [Payment agents and passporting](https://wiki.private.law/en/payment-agents-eu) sets out how agents and distributors are registered and how far the principal answers for them.

> ⚠️ An agent network that counts as an establishment brings the principal under host-state AML law for the business done through it, and [that compliance is supervised by the host authority](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02015L0849-20241230). The agents themselves are not obliged entities under the EU AML directive, so the obligations sit with the licensed institution.

### Online services: where is the service provided?

A firm that serves clients online from its home state may still ask whether it is providing services "in" another member state at all. There is no bright-line rule.

The EBA's 2019 report on cross-border impediments describes the test drawn from the Commission's 1997 interpretative communication: [only activities carried out on the territory of another member state require prior notification](https://www.eba.europa.eu/sites/default/files/document_library/EBA%20Report%20on%20potential%20impediments%20to%20the%20cross-border%20provision%20of%20banking%20and%20payment%20services.pdf), and the place is found where the "characteristic performance", the essential service for which payment is due, is supplied. Advertising and offers made at a distance do not require prior notification in that reading.

The EBA also records that national criteria diverge and that the communication needs updating for digital services, so the same online model can be treated differently by different host authorities.

## The procedure, regime by regime

Each regime runs the same basic relay, notification to the home authority and transmission to the host, but on different clocks and with different start rules. The comparison uses the statutory maximum periods.

| Regime | Services passport | Branch or agents | Legal basis |
| --- | --- | --- | --- |
| Payment and e-money institutions | Home forwards within one month; host assesses within one month; home decides within three months | Same clock; the agent or branch starts only once entered in the home register | PSD2 Arts 28–30; EMD2 Art. 3 |
| Investment firms | Home forwards within one month, then the firm may start | Home forwards within three months; start on the host's communication or two months after transmission at the latest | MiFID II Arts 34–35 |
| Crypto-asset service providers | Home forwards within ten working days; start on confirmation or on day 15 at the latest | Branch allowed; no physical presence required in the host state | MiCA Arts 59(7), 65 |
| Banks | Home forwards within one month | Home forwards within three months; host has two months to prepare supervision and set general-good conditions | CRD Arts 33–39 |

The statutory maxima run from 15 days for a crypto-asset services passport to five months for a bank or investment-firm branch. Where each clock starts, and what the host can do while it runs, differs by regime.

### Payment and e-money institutions: PSD2 and EMD2

Before providing payment services in another member state for the first time, a payment institution [notifies its home authority](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02015L2366-20250117) of its identity and authorisation number, the target states, the services, the details of any agents, and, for a branch, its business plan, organisation and managers. Outsourcing of operational functions in the host state must be reported as well; how outsourcing is governed is covered in [outsourcing by licensed firms](https://wiki.private.law/en/outsourcing-licensed-firms).

The passporting rules distinguish [three kinds of application: branch, services and agent](https://eur-lex.europa.eu/eli/reg_del/2017/2055/oj), with separate templates for e-money distributors. A branch application includes a business plan with a forecast budget for the first three financial years and a description of the branch's governance, internal controls and AML arrangements.

PSD2 Art. 28 then runs in a fixed order:

  1. The clock starts only when the home authority has a complete and accurate application; if it is incomplete, [the home authority informs the institution without delay](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02017R2055-20250220), stating what is missing.
  2. The home authority forwards the notification to the host authority within one month.
  3. The host authority has one month to assess it and report concerns, in particular reasonable grounds for money-laundering or terrorist-financing concern about an intended agent or branch.
  4. If the home authority's assessment is not favourable, in particular in light of the host's information, it must refuse to register the agent or branch, or withdraw a registration already made.
  5. The home authority communicates its decision within three months of receiving the complete information; an agent or branch may start only once entered in the home register, and the institution notifies the start date.
Home registers feed the EBA's [free public central register](https://euclid.eba.europa.eu/register/pip/search) of payment and e-money institutions, their agents and branches.

E-money institutions use the same procedure. [EMD2 Art. 3](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02009L0110-20180113) applies PSD2 Arts 28–31 to them; an EMI may distribute and redeem e-money in another member state through distributors under that procedure, but it may not issue e-money through agents. A registered account information service provider can also passport its registration, because PSD2 Art. 33 applies the section containing Art. 28 to it; the business model is covered in [open banking: AISP and PISP](https://wiki.private.law/en/open-banking-aisp-pisp).

### Investment firms: MiFID II

An investment firm may provide in other member states [the investment services and ancillary services covered by its authorisation](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02014L0065-20260606); host states may not impose additional requirements on matters the directive covers. Ancillary services can be passported only together with an investment service or activity.

For a services passport the firm notifies its home authority of the target state and a programme of operations, including any tied agents established at home. The home authority forwards it within one month, after which the firm may start.

For a branch, the home authority forwards the notification within three months unless it doubts the adequacy of the firm's administrative structure or financial situation. The branch may start when the host authority communicates with it or, failing that, two months after the home authority's transmission at the latest. A tied agent established in another member state is treated as a branch and follows the branch rules. The Bulgarian route is covered in [the Bulgarian investment firm licence](https://wiki.private.law/en/bulgaria-investment-firm).

### Crypto-asset service providers: MiCA

A MiCA-authorised CASP may provide its services throughout the Union through a branch or across the border, and [does not need a physical presence in a host state](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02023R1114-20240109). The home state must still be real, however: the CASP must have its registered office in a member state where it carries out at least part of its crypto-asset services, its place of effective management in the Union, and at least one director resident in the Union (Art. 59(2)).

To serve more than one member state, the CASP notifies its home authority of the target states, the services, the starting date and its activities outside MiCA. The home authority passes this to the host single points of contact, ESMA and the EBA within ten working days. The CASP may start once it receives the home authority's confirmation or, at the latest, on the 15th calendar day after submitting the information (Art. 65).

Banks, investment firms, EMIs and other financial entities that provide crypto-asset services on the basis of a MiCA Art. 60 notification are exempted only from Arts 62, 63, 64, 67, 83 and 84; the cross-border procedure of Art. 65 still applies to them. The regime as a whole is set out in [MiCA in the EU](https://wiki.private.law/en/mica-eu) and the licence itself in [the CASP licence guide](https://wiki.private.law/en/casp-license-guide).

### Banks: CRD

A credit institution may carry out in other member states, [through a branch or by providing services](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02013L0036-20250117), the Annex I activities covered by its authorisation (CRD Art. 33).

For a services passport the bank notifies its home authority of the activities it intends to carry out, and the home authority sends the notification to the host within one month (Art. 39).

For a branch, the home authority forwards the programme of operations, address and managers within three months, with data on own funds, unless it doubts the bank's administrative structure or financial situation. The host then has two months to prepare supervision and, if necessary, set the conditions under which the activities must be carried out in the interest of the general good; the branch may start on the host's communication or when the two months expire (Arts 35–36).

Inside the banking union the SSM Framework Regulation adapts this relay ([Arts 11–17 of Regulation 468/2014](https://eur-lex.europa.eu/eli/reg/2014/468/oj)): a branch in another participating member state may open unless the ECB, for a significant bank, or the home authority, for a less significant one, decides otherwise within two months, and in several of these procedures the ECB exercises the home or host authority's powers for significant institutions.

All places of business a bank sets up in the same host state count as a single branch (Art. 38). The authorisation itself is covered in [the EU banking licence and the ECB](https://wiki.private.law/en/eu-banking-license-ecb).

## What the host state can still impose

Home control is the rule, but each regime lists what the host authority keeps. The table sets these powers side by side.

| Regime | Host rules | Emergency measures |
| --- | --- | --- |
| [PSD2 Arts 29, 30, 100(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02015L2366-20250117) / EMD2 | For agents and branches under establishment, the host enforces the transparency and user-rights rules (Titles III–IV) and may require periodic reporting | Precautionary measures in emergencies, pending home action: proportionate, temporary and notified |
| [MiFID II Arts 35(8), 86](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02014L0065-20260606) | Branch services must meet host conduct rules (MiFID II Arts 24, 25, 27, 28; MiFIR Arts 14–26) | After persistent prejudicial conduct, measures including a ban on new transactions; referral to ESMA |
| [MiCA Art. 102](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02023R1114-20240109) | Host notifies the home authority and ESMA of suspected irregularities | If infringements persist, measures including a stop on further activity in the host state |
| [CRD Arts 43, 44, 46](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02013L0036-20250117) | General-good conditions for branches; advertising subject to host general-good rules on form and content | Precautionary measures, which may include a suspension of payment |

In most regimes the host's ordinary powers attach to an establishment, while its emergency powers reach further.

EU sanctions sit outside this split altogether. [Regulation 833/2014 applies](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02014R0833-20260724) to every legal person incorporated under the law of a member state and to any business done in whole or in part in the Union (Art. 13), so a passported firm carries its sanctions obligations into every host state it serves.

### Two different central contact points

A host state may require a payment or e-money firm to appoint a central contact point on its territory, and two separate rules allow it.

| Feature | PSD2 contact point | AML contact point |
| --- | --- | --- |
| Legal basis | [PSD2 Art. 29(4); Del. Reg. 2020/1423](https://eur-lex.europa.eu/eli/reg_del/2020/1423/oj) | [AMLD Art. 45(9); Del. Reg. 2018/1108](https://eur-lex.europa.eu/eli/reg_del/2018/1108/oj) |
| Firms caught | Payment institutions operating through agents under establishment | E-money issuers, payment service providers and CASPs established in forms other than a branch |
| Criteria | 10 or more such agents; or over €3 million or 100 000 agent transactions in the last financial year, with at least two agents under establishment | 10 or more such establishments; e-money or payment volume over €3 million per financial year; or the information needed not provided |

The PSD2 contact point does not apply to e-money distributors: EMD2 Art. 3(4) excludes it. The AML criteria are not exhaustive either, since host states may also require an AML contact point on a risk basis.

> ⚙️ The AML criteria of Del. Reg. 2018/1108 are written for e-money issuers and payment service providers only. The Commission adopted a delegated regulation extending them to CASPs on 8 September 2026 ([C(2026) 6179](https://ec.europa.eu/transparency/documents-register/api/files/C%282026%296179_0/090166e5332041cc)); it is not yet in force.

## Who gets no passport

The passport has fixed limits. It attaches to a full authorisation from an EEA authority under the relevant act; the cases in the table fall outside that condition, and the last column shows the route that remains without an EEA licence.

| Situation | Reason | Alternative route |
| --- | --- | --- |
| Small PI or small EMI | Registered under a national waiver; the passport articles do not apply ([PSD2 Art. 32](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02015L2366-20250117); [EMD2 Art. 9](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02009L0110-20180113)) | None abroad; the head office must be where the business is actually done |
| Third-country investment firm | No EEA authorisation | A national branch for retail and elective professional clients; the MiFIR equivalence route for per se professionals and eligible counterparties |
| Third-country CASP | No MiCA authorisation | Only services at the client's own exclusive initiative |
| Third-country bank | No EEA authorisation; its branches may not be treated more favourably than EU branches | A branch under national rules; from 11 January 2027 an authorised branch under CRD VI |
| UK-licensed firm | The Brexit transition period ended on 31 December 2020 | The same routes as any third-country firm |

For investment firms, a member state [may require a third-country firm to set up a branch](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02014L0065-20260606) to serve retail clients and professional clients on request; the branch needs prior national authorisation, decided within six months of a complete application. Services to eligible counterparties and per se professional clients fall under [MiFIR Arts 46–47](https://eur-lex.europa.eu/eli/reg/2014/600/oj): after a Commission equivalence decision, an ESMA-registered third-country firm may serve them throughout the Union without a branch.

For banks, [CRD Art. 47(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02013L0036-20250117) bars more favourable treatment of third-country branches. [CRD VI adds Art. 21c](https://eur-lex.europa.eu/eli/dir/2024/1619/oj), which from 11 January 2027 requires third-country undertakings to establish an authorised branch to provide core banking activities in a member state, with exceptions for reverse solicitation, services to credit institutions and intragroup services.

For UK firms, the Brexit transition period [ended on 31 December 2020](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A12019W%2FTXT\(02\)); a UK licence is now a third-country authorisation. The UK side is mapped in [UK FCA licences](https://wiki.private.law/en/uk-fca-license-map). Working under another firm's EEA licence is a separate arrangement: [licence for rent](https://wiki.private.law/en/license-for-rent).

### Reverse solicitation is narrow

Under [MiCA Art. 61](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02023R1114-20240109) a third-country firm may serve an EU client without authorisation only where the client initiates the service at its own exclusive initiative. Any solicitation in the Union by the firm or anyone acting on its behalf, by any means, defeats the exemption regardless of contractual clauses or disclaimers, and it does not allow marketing new types of crypto-assets or services. MiFID II Art. 42 contains the same principle for investment services.

> ⚠️ [ESMA's reverse-solicitation guidelines](https://www.esma.europa.eu/sites/default/files/2025-02/ESMA35-1872330276-2030_Guidelines_on_reverse_solicitation_under_MiCA.pdf) read solicitation broadly, including brand advertising, sponsorship, influencers and geo-targeted ads, and read the client's exclusive initiative narrowly. Further offers of the same type are allowed only within the original transaction, and the guidelines mention geo-blocking as a precaution. They have applied since 2025: ESMA's versions in all official EU languages are dated 26 February 2025, and the guidelines apply 60 calendar days after that publication.

## Passporting out of Bulgaria

Bulgaria shows how the directives look once transposed and how a small market uses them. The Bulgarian National Bank (BNB) handles payment and e-money passports; the Financial Supervision Commission (FSC) handles investment firms and crypto-asset services.

### The BNB as home authority

Under [ZPUPS Art. 32](https://www.bnb.bg/bnbweb/groups/public/documents/bnb_law/laws_payment_services_bg.pdf), a BNB-licensed payment institution may operate in another member state through a branch, an agent or directly after notifying the BNB in writing. The BNB forwards the notification to the host authority within one month and communicates its decision within three months; an agent or branch may start only after entry in the BNB register under Art. 19. An e-money company uses the same procedure under Art. 43: it may operate directly or through a branch, distribute and redeem e-money or provide payment services through an agent, but it may not issue e-money through agents.

The registers show how far Bulgarian firms actually use the passport for direct services:

| Register | Notified firms | Host states |
| --- | --- | --- |
| [E-money institutions](https://www.bnb.bg/bnbweb/groups/public/documents/bnb_download/ps_po_register_3_bg.xlsx), updated 23 September 2026 | 7 of 13: iCard, PayNovus, Paynetics, Easy Payment Services, Tenen Payments, PayMan Group, MyFin | All 29 other EEA states for each |
| [Payment institutions](https://www.bnb.bg/bnbweb/groups/public/documents/bnb_download/ps_po_register_2_bg.xlsx), updated 31 August 2026 | 3 of 5: Datecs Payment Technology, Octis Pay, Iris Solutions | 29 for Datecs and Octis Pay; the 26 other EU states for Iris Solutions |

Bulgarian firms that use the passport notify all or almost all states at once: each EMI on the list is notified for every other EEA state. The licence behind it is described in [EMI and payment institution licences in Bulgaria](https://wiki.private.law/en/bulgaria-emi-license).

### The BNB as host authority

In the other direction, the BNB [assesses incoming payment passport notifications](https://www.bnb.bg/bnbweb/groups/public/documents/bnb_law/laws_payment_services_bg.pdf), including grounds for money-laundering or terrorist-financing suspicion about a branch or agent, and sends its assessment to the home authority within one month (ZPUPS Art. 33). Incoming institutions with agents under establishment must set up a central contact point where the BNB ordinance so requires, and in emergencies the BNB may take temporary supervisory measures. Such establishments fall under [the Bulgarian AML framework](https://wiki.private.law/en/bulgaria-aml-framework).

### The FSC: investment firms and crypto-assets

The FSC [handles MiFID passport notifications](https://eis.fsc.bg/services/296/) through its e-services: an investment firm that intends to provide services in a host state without a branch notifies the FSC in advance, and firms from other member states serving Bulgaria are registered there. For crypto-assets, [all notifications to a competent authority under MiCA are made to the FSC](https://www.fsc.bg/wp-content/uploads/2026/08/zpka_dv_71_2026.pdf) (ZPKA Art. 3(5)), which grants [CASP licences](https://wiki.private.law/en/bulgaria-casp-license); the BNB keeps specific powers over banks acting as CASPs or as issuers of asset-referenced tokens (ARTs) and over e-money token issuers.

Which Bulgarian regulator grants which licence is mapped in [financial licences in Bulgaria](https://wiki.private.law/en/bulgaria-financial-licenses). Lithuania and Luxembourg are the other common home states for EMIs, each with its own licence ([Lithuanian](https://wiki.private.law/en/emi-license-lithuania), [Luxembourg](https://wiki.private.law/en/emi-license-luxembourg)); the choice of home state is compared in [Lithuania vs Bulgaria for an EMI](https://wiki.private.law/en/emi-lithuania-vs-bulgaria) and, across regimes, in [the fintech licence map](https://wiki.private.law/en/fintech-license-map).

## What changes next

Four developments touch the passport, and they sit at different stages.

| Development | Status on 24 September 2026 | Effect on the passport |
| --- | --- | --- |
| PSD3 and the Payment Services Regulation | Not adopted; [ECON approved the agreed texts on 5 May 2026](https://oeil.secure.europarl.europa.eu/oeil/en/procedure-file?reference=2023%2F0209\(COD\)); as of September 2026, plenary forecast for 14 December 2026 | PSD3 would repeal PSD2 and EMD2, bringing payment and e-money services under one directive, passport provisions included |
| CRD VI, third-country branches | [Adopted](https://eur-lex.europa.eu/eli/dir/2024/1619/oj); applies from 11 January 2027 | Authorised branch required for core banking activities from outside the EEA, with exceptions; Title VI on third-country branches replaced |
| AML contact-point criteria for CASPs | Adopted by the Commission on 8 September 2026; not in force | Would extend the Del. Reg. 2018/1108 criteria to CASPs |
| End of the MiCA transitional period | [Closed on 1 July 2026 at the latest](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02023R1114-20240109) | Crypto-asset services now require a MiCA authorisation or an Art. 60 notification |

PSD3 and the PSR reached a provisional agreement on 27 November 2025 and remain procedures [2023/0209(COD)](https://oeil.secure.europarl.europa.eu/oeil/en/procedure-file?reference=2023%2F0209\(COD\)) and [2023/0210(COD)](https://oeil.secure.europarl.europa.eu/oeil/en/procedure-file?reference=2023%2F0210\(COD\)); until they are adopted and apply, PSD2 and EMD2 govern payment passports. What the reform would change is followed in [PSD3 and the PSR](https://wiki.private.law/en/psd3-psr), and the parallel AML reform in [the EU AML package](https://wiki.private.law/en/eu-aml-package).

## Q/A

### Procedure and timing

### **How long does it take to passport a payment or e-money licence?**

Under PSD2 the home authority forwards a complete notification within one month, the host has one month to assess it, and the home authority decides within three months of receiving the complete information. An agent or branch can start only once it is entered in the home register. The clock does not run while the application is incomplete.

### **When can a firm start serving clients in the host state?**

It depends on the regime. An investment firm with a services passport may start once the home authority has forwarded its notification, which must happen within one month. A CASP may start on the home authority's confirmation or on the 15th calendar day at the latest. A bank or investment-firm branch waits for the host's communication or for the two months after transmission to expire.

### **Does an EMI need to passport its distributors?**

Yes. Distributing and redeeming e-money through distributors in another member state runs through the same PSD2 passport procedure, with separate templates. Issuing e-money through agents is not allowed at all.

### Host-state powers

### **Can the host regulator block a passport?**

The decision belongs to the home authority. Under PSD2 the host reports its concerns, in particular on money laundering, and the home authority must refuse or withdraw the registration of an agent or branch if its own assessment, informed by the host's, is unfavourable. Under CRD the host can attach general-good conditions to a bank branch, and every regime gives it emergency powers.

### **Which host-state rules apply to a passported firm?**

Mostly those tied to an establishment: conduct rules for MiFID II branches, the PSD2 transparency and user-rights rules for payment agents and branches, and host AML law where an agent network is an establishment. Banks must also respect host general-good rules on advertising.

### **When can a host state require a central contact point?**

Under PSD2, where a payment institution has 10 or more agents under establishment there, or agent business above €3 million or 100 000 transactions with at least two agents under establishment. Under the AML directive, where an e-money issuer or payment service provider has 10 or more non-branch establishments, over €3 million per year, or fails to provide the information, and also on a risk basis.

### Limits of the passport

### **Does a UK licence give access to EU clients?**

No. Since the Brexit transition period ended on 31 December 2020, a UK licence is a third-country authorisation and carries no EEA passport. A UK firm needs an EEA authorisation or a third-country route, such as a national branch.

### **Can a small payment or e-money institution passport?**

No. Institutions registered under the PSD2 or EMD2 small-institution waivers have no passport and must have their head office where they actually do business.

### **Is reverse solicitation a way to serve EU clients without a licence?**

Only for business the client initiates at its own exclusive initiative. Any solicitation by the firm or on its behalf, including brand advertising or influencers under ESMA's guidelines, removes the exemption, and it never allows marketing new types of products or services.

---

## Factual claims

- The territory is the EEA: the 27 EU member states plus Iceland, Liechtenstein and Norway, so a passport reaches up to 29 host states.
- The regime as it stands in September 2026:
- The statutory maxima run from 15 days for a crypto-asset services passport to five months for a bank or investment-firm branch.
- The PSD2 contact point does not apply to e-money distributors: EMD2 Art. 3(4) excludes it.
- For banks, CRD Art. 47(1) bars more favourable treatment of third-country branches.
- For UK firms, the Brexit transition period ended on 31 December 2020; a UK licence is now a third-country authorisation.
- Under MiCA Art. 61 a third-country firm may serve an EU client without authorisation only where the client initiates the service at its own exclusive initiative.
- Bulgaria shows how the directives look once transposed and how a small market uses them.

---

Source: wiki.private.law — the private.law legal knowledge base. When quoting, cite the canonical page URL.
Consultation with a lawyer: https://t.me/private_law_bot