Concept
An investment firm is a legal person whose regular occupation or business is providing investment services to third parties or performing investment activities on a professional basis (Article 4(1)(1) MiFID II). The activity is reserved in the EU: it requires prior authorisation from the competent authority of the home Member State (Article 5). A broker, a portfolio manager, an investment adviser and an underwriter are the same type of regulated entity with different sets of authorised services; a trading facility (MTF or OTF) may be operated either by an investment firm or by a market operator (Article 5(2)).
The regime exists for the single market. One national regulator grants the authorisation, and it is valid throughout the Union: the firm serves other Member States directly or through a branch (Article 6(3)). In return the home state is responsible for capital, organisation and client protection, and the baseline requirements for all 27 countries come from MiFID II, the Investment Firms Directive (IFD) and the directly applicable Investment Firms Regulation (IFR). Where this regime sits among other financial licences is shown in the Financial Licences hub.
One path from start to finish
A group wants to offer brokerage accounts to clients in several EU countries. The route from incorporation to operating in other states takes five steps.
- The group incorporates a company in the chosen home Member State, with its head office in the same state as its registered office (Article 5(4)(a)), directed by at least two people working there.
- The company applies for reception and transmission of orders, execution of orders and the ancillary service of safekeeping.
- Because it will hold client money and securities, its initial capital is €150 000, and under the IFR it falls into class 2 and calculates K-factors.
- Before authorisation the company joins the investor compensation scheme.
- Once authorised, it notifies its regulator of cross-border services; within one month the regulator forwards the notification to the host states, and the firm starts operating there without a second licence.
What defines the model
Three features of the regime determine how it is used.
A licence for services
The authorisation lists specific services from a closed list. Extending it requires a new request to the regulator (Article 6(2)), and ancillary services are never granted on their own.
Capital follows risk
Initial capital is €75 000, €150 000 or €750 000, depending on whether the firm holds client assets and puts its own balance sheet at risk. After that, own funds are recalculated under the IFR.
One supervisor, one market
The passport opens other Member States by notification. A host state may not add its own requirements on matters covered by MiFID II.
Key parameters
EU law fixes the list of services and the initial capital thresholds; national law adds procedure, deadlines and fees.
| Acts and regulator | MiFID II, IFD, IFR; national competent authority of the home Member State |
|---|---|
| Permitted activity | Nine services and activities in Annex I Section A; seven ancillary services in Section B, only together with them |
| Initial capital | €75 000, €150 000 or €750 000 (Article 9 IFD) |
| Own funds | Highest of the fixed overheads requirement, permanent minimum capital and K-factor requirement (Article 11 IFR) |
| Decision deadline | No more than six months from a complete application (Article 7(3) MiFID II) |
| Substance | Head office in the state of registration; at least two persons effectively directing the business (Articles 5(4), 9(6)) |
| Passport | Services: one month after notification; branch: up to three months plus up to two (Articles 34–35) |
| Client assets | Segregation of money and instruments; compensation scheme of at least €20 000 per investor |
What is licensed: services and activities
Annex I Section A to MiFID II contains a closed list of nine investment services and activities. The authorisation names those the firm may provide, and every capital rule refers to these numbers.
| No. | Service or activity | Initial capital (Article 9 IFD) |
|---|---|---|
| 1 | Reception and transmission of orders | €75 000; €150 000 if the firm holds client assets |
| 2 | Execution of orders on behalf of clients | €75 000; €150 000 if the firm holds client assets |
| 3 | Dealing on own account | €750 000 |
| 4 | Portfolio management | €75 000; €150 000 if the firm holds client assets |
| 5 | Investment advice | €75 000; €150 000 if the firm holds client assets |
| 6 | Underwriting or placing on a firm commitment basis | €750 000 |
| 7 | Placing without a firm commitment basis | €75 000; €150 000 if the firm holds client assets |
| 8 | Operation of a multilateral trading facility (MTF) | €150 000 |
| 9 | Operation of an organised trading facility (OTF) | €150 000; €750 000 if the operator may deal on own account |
The dividing line is risk to other people's money and to the firm's own balance sheet. Services 3 and 6 expose the firm's balance sheet and therefore require full capital; for intermediary services the threshold turns on one question — whether the firm may hold client money and securities.
Section B adds seven ancillary services:
- safekeeping and administration of client financial instruments, including custodianship;
- credit or loans to an investor for a transaction in which the firm is involved;
- advice to undertakings on capital structure and M&A;
- foreign exchange connected with investment services;
- investment research;
- underwriting-related services;
- services relating to the underlyings of certain derivatives.
Authorisation is never granted solely for ancillary services (Article 6(1)), and they travel abroad only together with a core service (Articles 34–35). Custody is therefore an add-on to a brokerage or portfolio-management licence.
Who stays outside the regime
Article 2 MiFID II excludes those for whom investment services are incidental or internal. The exemptions include insurers within their own business, services provided only to a parent and group companies, services provided incidentally within a regulated profession, unremunerated advice given incidentally, collective investment undertakings, pension funds and their managers, and crowdfunding service providers under their own EU regulation.
A trader dealing only on own account also falls outside, as long as it is not a market maker, is not a member of a trading venue (with exceptions), does not use high-frequency algorithmic trading and does not deal on own account when executing client orders (Article 2(1)(d)).
Article 3 allows Member States a national regime for the lightest intermediaries. It covers persons who do not hold client money or securities, are limited to reception and transmission of orders in transferable securities and fund units and advice on them, and transmit orders only to licensed firms, banks and funds. National law must apply requirements analogous to MiFID II and mandatory investor compensation cover or professional indemnity insurance (Article 3(2)). This regime carries no passport: such persons do not enjoy the freedom to provide services or to establish branches (Article 3(3)).
Management and substance
Authorisation goes to a company that genuinely operates in its home Member State. At least two persons of sufficient repute, knowledge and time commitment must effectively direct the business (Article 9(6) MiFID II); a state may admit a firm with a single director only with alternative arrangements that ensure sound and prudent management. Delegated Regulation 2017/565 requires a permanent, independent compliance function, and risk management and internal audit functions where appropriate and proportionate (Articles 22–24).
In its opinion of 13.07.2017 ESMA called on regulators to prevent letter-box entities. Senior managers and key compliance and risk staff should be located in the home state and take real decisions; where they do not, the regulator may refuse or withdraw authorisation.
Capital: the IFD sets the entry, the IFR the running requirement
Initial capital is a condition of authorisation (Article 15 MiFID II, referring to Article 9 IFD). The threshold follows the riskiest service applied for.
| Model | Condition | Initial capital |
|---|---|---|
| Adviser, agency broker or manager without client assets | Services 1, 2, 4, 5, 7 without permission to hold client money or securities (Article 9(2)) | €75 000 |
| Broker or manager holding client assets; MTF operator | All firms not covered by paragraphs 1, 2 and 4 (Article 9(3)) | €150 000 |
| Dealer, underwriter, OTF dealing on own account | Services 3 or 6; service 9 with permission to deal on own account (Article 9(1) and (4)) | €750 000 |
An operating firm lives by a different rule. Under Article 11 IFR its own funds must at all times be at least the highest of three amounts: the fixed overheads requirement (one quarter of the previous year's fixed overheads; for a new firm, the first-year projection from its application), the permanent minimum capital requirement (no lower than initial capital under Article 9 IFD) and the K-factor requirement.
Separately, the IFR requires liquid assets of at least one third of the fixed overheads requirement (Article 43). For a firm whose fixed overheads exceed four times its initial capital, one quarter of overheads sets the requirement if K-factors are not higher; the entry threshold then becomes a floor. How K-factors are calculated and how this design differs from bank and payment regimes is covered in Regulatory Capital.
Three classes of investment firm
The IFR sorts firms by size and interconnectedness, and the class determines which of the three amounts is calculated at all.
| Class | Who belongs | Prudential regime |
|---|---|---|
| Class 1 | Dealers and underwriters with consolidated assets of €15 bn or more; at the regulator's discretion from €5 bn. From €30 bn such a firm becomes a credit institution | Bank requirements under the CRR; from €30 bn a credit institution licence |
| Class 2 | All firms below the class 1 thresholds that fail at least one small and non-interconnected condition | Highest of fixed overheads, permanent minimum and K-factors |
| Class 3 | Small and non-interconnected firms meeting all conditions of Article 12(1) IFR at once | Higher of fixed overheads and permanent minimum, without K-factors |
Class 3 is the lightest regime, and a single breached condition ends it. The main traps are the zero thresholds: a firm that holds even part of its clients' money or instruments leaves class 3 regardless of size.
Class 3 conditions: nine metrics
All conditions of Article 12(1) IFR apply at the same time.
| Metric | Limit |
|---|---|
| Assets under management (K-AUM) | below €1.2 bn |
| Client orders handled (K-COH) | below €100 m a day for cash trades or €1 bn a day for derivatives |
| Assets safeguarded and administered (K-ASA) | zero |
| Client money held (K-CMH) | zero |
| Daily trading flow (K-DTF) | zero |
| Net position risk or clearing margin (K-NPR, K-CMG) | zero |
| Trading counterparty default (K-TCD) | zero |
| Balance sheet total | below €100 m |
| Total annual gross revenue | below €30 m |
Client money and instruments
Client protection works on two levels. The first is segregation. A firm holding client financial instruments must safeguard clients' ownership rights, especially in its own insolvency, and may not use them on own account without the client's express consent; it likewise safeguards client funds and does not use them for its own account (Article 16(8) and (9) MiFID II). Title transfer financial collateral arrangements with retail clients are prohibited (Article 16(10)).
The second level is the investor compensation scheme under Directive 97/9/EC. Every authorised firm must belong to one (Article 2(1)), and the regulator checks this at authorisation (Article 14 MiFID II).
The scheme pays when the firm cannot return a client's money or instruments. Minimum cover is €20 000 per investor (Article 4(1) of the directive); a Member State may pay only a share of the claim, of no less than 90%, as long as the payout is below €20 000 (Article 4(4)), and exclude certain categories of investor (Article 4(2) and Annex I). A comparison with deposit guarantees and payment-firm safeguarding is in the Client Asset Protection Map.
The passport: services, branch and tied agent
The licence is valid throughout the Union, but it can be used abroad in three ways that differ in timing and in whose rules apply to clients.
| Route | Timing | Whose conduct rules |
|---|---|---|
| Cross-border services (Article 34) | The regulator forwards the notification within one month, after which the firm may start | Home state |
| Branch (Article 35) | Up to three months to forward; start on the host authority's communication, at the latest two months after transmission | Host state for the branch's services (Article 35(8)) |
| Tied agent in another Member State (Article 35(2)) | As for a branch | Assimilated to a branch |
A tied agent is distribution without its own licence. It solicits clients, receives and transmits orders, places instruments and advises on the services of one firm, which remains fully and unconditionally responsible for its acts; the agent is entered in the public register of the Member State where it is established (Article 29). How a business operates under someone else's regulation is covered in License for Rent, and the passport procedure across regimes in EU Passporting.
Third-country firms and the client's own initiative
A firm from outside the EU reaches EU clients by different routes depending on the client category.
| Client | Route | Legal basis |
|---|---|---|
| Retail and elective professional | A locally authorised branch where the state requires one | Article 39 MiFID II |
| Per se professional and eligible counterparty | ESMA registration after a Commission equivalence decision; absent one, the state's national regime | Articles 46–47 MiFIR, Article 46(4) |
| Any client who approaches the firm | No authorisation, only at the client's exclusive initiative | Article 42 MiFID II |
The last route is an exception (reverse solicitation), and it is narrow by design. Any solicitation of clients in the Union by the firm, by an entity acting on its behalf or closely linked to it, or by anyone acting for such an entity removes the exception; this wording was added by the IFD amendments. The client's approach does not entitle the firm to market new categories of products or services to that client (Article 42(2)).
In its statement of 13.01.2021 ESMA described how the rule is circumvented: general clauses in terms of business and online "I agree" pop-ups in which the client confirms that it came on its own. Such clauses have no effect, because solicitation is assessed across every channel, including press releases, internet advertising, brochures, calls and meetings. Under MiCA the same principle is written into Article 61 expressly: contractual disclaimers do not help. Fund marketing follows separate rules — see Cross-Border Fund Distribution.
The product and the retail client
MiFID II regulates the product together with the service. A firm that manufactures financial instruments approves each one before sale, identifies a target market, assesses the risks for it and designs a consistent distribution strategy; a distributor must understand the instrument and its target market (Article 16(3)) and offer it only in the client's interest (Article 24(2)).
Retail derivatives are subject to product intervention on top of this. In 2018 ESMA restricted CFDs for retail clients and banned the sale of binary options to them.
| Measure | Content |
|---|---|
| Leverage | From 30:1 for major currency pairs down to 2:1 for cryptocurrencies; 20:1, 10:1 and 5:1 for other underlyings |
| Margin close-out | At 50% of minimum required margin, per account |
| Negative balance | Protection per account |
| Incentives and warnings | Restriction on trading incentives; standardised warning with the share of losing retail accounts |
| Binary options | Sale to retail clients prohibited from 02.07.2018 |
ESMA's measures were renewed until 31.07.2019 and then replaced by permanent national measures of all competent authorities that largely mirror the ESMA decision. In a statement of 24.02.2026 ESMA said that leveraged derivatives marketed as perpetual futures, including on Bitcoin and Ether, are likely to fall within these measures: the commercial name is irrelevant, the target market should be narrow, mass marketing is inconsistent with it, and a PRIIPs KID is required for retail clients.
The product rules are due for revision. Parliament and Council reached a provisional agreement on the Retail Investment Strategy package on 18.12.2025; according to the Commission, publication in the Official Journal is expected by January 2027 at the latest, with the new rules applying from around July 2029. Until then the current MiFID II rules apply.
Crypto broker: MiFID II or MiCA
The classification of the asset decides the regime. MiCA does not apply to crypto-assets that qualify as financial instruments (Article 2(4)(a) MiCA): tokenised securities and crypto derivatives remain under MiFID II. Other crypto-assets are served by a crypto-asset service provider (CASP).
| Parameter | Investment firm (MiFID II) | CASP (MiCA) |
|---|---|---|
| What it serves | Financial instruments, including crypto derivatives and tokenised securities | Crypto-assets that are not financial instruments |
| Minimum capital | €75 000 – €750 000 | €50 000, €125 000 or €150 000 (Annex IV MiCA) |
| Route to the other regime | Equivalent crypto-asset services on 40 working days' notice (Article 60(3) MiCA) | Financial instruments require a MiFID II licence |
The practical link follows: an investment firm can add crypto-asset services by notification, while a CASP needs a separate licence for derivatives and tokenised securities. The CASP procedure is covered in The MiCA CASP Licence, the regime itself in MiCA.
Where firms are licensed: six jurisdictions
The list of services, capital and passport are the same everywhere; states differ in regulator, national law, deadlines and fees.
| State | Regulator and law | Decision deadline | Features |
|---|---|---|---|
| Cyprus | CySEC; Law 87(I)/2017 | Up to six months (MiFID II) | Application fee: €7 000 for services 1–7, €25 000 for an MTF or OTF, €500 per ancillary service; compensation is the lesser of 90% and €20 000 |
| Malta | MFSA; Investment Services Act (Cap. 370) | Up to six months (MiFID II) | For capital purposes, holding client money includes controlling it, for example under a power of attorney |
| Lithuania | Bank of Lithuania; Law on Markets in Financial Instruments | Up to six months from a complete file | State levy €947; a national Article 3 regime for advisory companies |
| Bulgaria | FSC; Markets in Financial Instruments Act | Three months from confirmed completeness | Compensation 90%, capped at €20 000 (Article 77g, Public Offering of Securities Act) |
| Ireland | Central Bank of Ireland; S.I. No. 375 of 2017 | Up to six months (MiFID II) | IFD transposed by a separate S.I. No. 355/2021; compensation under the Investor Compensation Act 1998 |
| Luxembourg | CSSF; Law of 5 April 1993 on the financial sector | Six months, and in any event no more than 12 | No decision within 12 months counts as refusal |
The deadlines in the table are statutory maximums. Local staffing requirements, supervisory fees and taxes are covered by the country articles: Cyprus and Bulgaria.
Russian owners and clients
Regulation (EU) 833/2014 does not prohibit Russian nationals or residents from owning an investment firm that provides only MiFID II services. The regulator assesses a proposed acquirer of a qualifying holding against the five criteria in Article 13(1) MiFID II — reputation, the experience of those who will direct the business, financial soundness, the firm's ability to meet prudential requirements, and money-laundering risk.
Nationality as such is not a criterion, but the fifth one applies to Russia with particular force: since 29.01.2026 Russia has been on the EU list of high-risk third countries for AML/CFT purposes (Delegated Regulation 2026/46), which means enhanced due diligence on business relationships and owners connected with Russia. More in Qualifying Holdings and Fit & Proper. The regulation's prohibitions mainly target services and transactions; the provisions that matter for an investment firm are set out below, together with the asset freeze under Regulation 269/2014.
| Provision | What is prohibited | Who is affected |
|---|---|---|
| Article 5f | Selling securities in an EU currency issued after 12.04.2022 (other currencies: after 06.08.2023) and fund units exposed to them | Russian nationals and residents, entities established in Russia |
| Article 5e | EU central securities depository services for securities issued after 12.04.2022 | The same persons; the prohibition is addressed to the depository |
| Articles 5 and 5a | Transactions and investment services in new securities of listed state-linked companies and banks, Russia and the Central Bank of Russia | All EU market participants |
| Article 5b(2) | MiCA crypto-asset services, issuing payment instruments, acquiring, payment initiation, issuing e-money | Russian nationals and residents, entities established in Russia |
| Articles 5bb and 5bc | Any transaction with crypto-asset service providers and platforms established in Russia (from 24.05.2026) and in third countries listed in Annex LVII | All EU market participants |
| Article 5m | Registering trusts and providing trustee, registered-office and management services to trusts with Russian trustors or beneficiaries | Trusts connected with Russia |
| Article 5b(2a) | Owning, controlling or sitting on the governing bodies of an EU company providing crypto-asset services: wallet and custody since 18.01.2024, any MiCA service since 25.08.2026 | Russian nationals and natural persons residing in Russia |
| Regulation 269/2014, Article 2 | Freezing of funds and economic resources; ban on making funds available to them, directly or indirectly | Persons listed in Annex I to Regulation 269/2014 |
For a broker the key provision is Article 5f: it closes the core product line — securities in an EU currency issued after 12.04.2022, in any other currency after 06.08.2023, and funds holding them — to a client with Russian nationality or residence. Article 5e is addressed to depositories: an EU central securities depository does not provide services for such securities to the same persons. The ban on deposits above €100 000 under Article 5b(1) is addressed to credit institutions and does not directly affect an investment firm.
Articles 5b, 5e and 5f share the same exemption: their prohibitions do not apply to nationals of EU, EEA and Swiss states or to natural persons holding a temporary or permanent residence permit there — even if the person lives in Russia (Articles 5b(3), 5e(2), 5f(2)).
The exemption is framed for natural persons. For an investment firm with a Russian UBO this means there is no sanctions bar on the core MiFID II business, while crypto-asset services are closed as long as a UBO without EU, EEA or Swiss nationality or residence participates in its capital or management: custody and wallets since 18.01.2024, all other MiCA services since 25.08.2026. The overall sanctions map is in Sanctions: a Route Map.
Popular but ends badly
The regime is narrow where the market is used to reading it broadly. The first practice is relying on the client's approach while marketing actively.
Three other practices are undermined by the design of the regime itself.
| Practice | Why it fails |
|---|---|
| A leveraged derivative renamed a perpetual future | According to ESMA, the name, venue trading and voluntary negative balance protection do not take it outside the CFD restrictions |
| A tied-agent network instead of a branch | The firm answers for every act of the agent, an agent in another state falls under the branch regime, and the local regulator supervises conduct rules there |
| Counting on class 3 with an adviser model | Once the firm begins to hold client money, it moves to class 2 with K-factors and different capital |
In all three cases the regulator looks at the actual business, and any gap with the declared model surfaces in supervision.
Q/A
Licence and capital
Can a firm be licensed for custody only?
No. Safekeeping and administration of client instruments is an ancillary service in Section B, and authorisation is never granted for ancillary services alone (Article 6(1) MiFID II). Custody is added to a brokerage or portfolio-management licence.
Is €75 000 enough if the firm only transmits orders?
Yes, as an entry threshold — as long as the firm is not permitted to hold client money and securities. After that, own funds must also cover one quarter of annual fixed overheads, so with a meaningful headcount the effective requirement is higher.
What does the IFR class change in practice?
Class 3 removes the K-factor calculation. A firm that holds even part of its clients' money or instruments falls into class 2 and calculates own funds as the highest of three amounts.
Passport and foreign clients
How long does it take to start in another EU state?
For cross-border services the regulator forwards the notification within one month, after which the firm may start. A branch takes up to three months for transmission and up to two months waiting for the host authority.
Can a UK or offshore-licensed firm serve EU clients?
It depends on the client. For retail clients an EU state may require a locally authorised branch. Per se professional clients and eligible counterparties can be served after ESMA registration (Articles 46–47 MiFIR) or, while there is no equivalence decision, under the state's national regime where one exists. Otherwise only the narrow Article 42 exception remains: the client came on its own and the firm carries out no solicitation in the EU.
Does the Article 3 national regime give a passport?
No. Persons exempted under Article 3 MiFID II do not enjoy the freedom to provide services or to establish branches; their business is confined to one state.
Client protection and sanctions
How much does a client recover if the firm fails?
MiFID II requires client assets to be segregated so that the client's ownership rights are protected in the firm's insolvency. If they cannot be returned, the compensation scheme covers the claim up to a limit of no less than €20 000 per investor; a state may pay a share of the claim of no less than 90% while the amount is below €20 000.
Can a Russian national own an EU investment firm?
Regulation 833/2014 does not prohibit owning a firm that provides only MiFID II services. The ownership ban concerns firms providing crypto-asset services: for custody and wallets since 18.01.2024, for other MiCA services since 25.08.2026. It does not extend to owners holding EU, EEA or Swiss nationality or a residence permit there.
Can euro bonds be sold to a Russian national?
Securities issued after 12.04.2022 only if the client holds EU, EEA or Swiss nationality or a residence permit there (Article 5f(2)). Otherwise the sale is prohibited by Article 5f of Regulation 833/2014.