Passporting and Cross-Border Licensing Post-Brexit — UK Firms' Options

The End of Passporting

From 1 January 2021, UK-authorised financial services firms lost the ability to "passport" their services into EU/EEA member states. Under the pre-Brexit framework, a firm authorised in one EEA state could provide services across all 30 EEA states without obtaining separate authorisations — either through establishment of a branch (freedom of establishment) or on a services basis (freedom of services).

The loss of passporting affects all categories of regulated firms — including payment institutions, electronic money institutions, investment firms, banks, insurance companies and fund managers. This guide examines the options available to UK firms that wish to continue serving EU/EEA customers.

Option 1: Establish an EU/EEA Subsidiary

The most common — and most reliable — route for UK firms to access EU markets is establishing a separately authorised subsidiary in an EU/EEA member state. Once authorised in one member state, the subsidiary can passport its services across the entire EEA.

Choosing a jurisdiction:

The choice of jurisdiction depends on several factors including regulatory approach, speed of authorisation, language, tax regime and operational costs. Popular choices include:

Lithuania: - The Bank of Lithuania has actively positioned itself as a gateway for fintech firms seeking EU access - Relatively fast authorisation timelines (3–6 months for EMIs and PIs) - Lower operational costs than Western European alternatives - English is widely used in regulatory engagement - Minimum capital requirements align with EU minimums

Ireland: - The Central Bank of Ireland is one of the most experienced EU regulators - English-speaking jurisdiction with common-law legal tradition - Strong regulatory reputation that facilitates passporting acceptance across the EEA - Higher operational costs and more intensive supervisory approach than some alternatives - Significant substance requirements — Ireland expects genuine local operations, not "brass plate" entities

The Netherlands: - De Nederlandsche Bank (DNB) is a well-respected regulator - Strategic location with strong financial services infrastructure - English is widely spoken in business contexts - Moderate operational costs - Strong fintech ecosystem

Substance requirements: All EU regulators require subsidiaries to have genuine local substance — not merely a registered office and a compliance officer. Minimum expectations typically include: - Local directors with genuine decision-making authority - Adequate local staffing (compliance, risk, operations) - IT infrastructure accessible from the local jurisdiction - Local board meetings and governance - Local bank accounts and financial infrastructure

The European Banking Authority (EBA) has published guidelines on "authorisation shopping" that require national regulators to ensure applicants have genuine substance and are not attempting to obtain the easiest authorisation to passport into jurisdictions with higher standards.

Option 2: Equivalence Decisions

The EU's regulatory framework includes provisions for the European Commission to grant "equivalence" to third-country regulatory regimes. An equivalence decision allows firms from the third country to provide specific services into the EU without establishing a local presence — subject to conditions.

Current status of UK equivalence: As of 2025, the European Commission has granted only limited equivalence decisions to the UK: - Central counterparties (CCPs): Temporary equivalence for UK CCPs, extended multiple times but remaining politically contingent - Central securities depositories (CSDs): Limited equivalence for settlement services

Broad equivalence decisions covering investment services, banking or payment services have not been granted and remain politically uncertain. The EU has indicated it prefers to develop its own financial services capacity ("strategic autonomy") rather than granting wide-ranging equivalence to the UK.

Implications: Equivalence is not a reliable strategy for market access. Decisions can be withdrawn with 30 days' notice, are subject to political considerations and do not cover all regulated activities. Firms that rely solely on equivalence expose themselves to significant regulatory and commercial risk.

Option 3: Reverse Solicitation

Under MiFID II (Article 42) and equivalent provisions in other EU directives, an EU customer may access services from a third-country firm at their own exclusive initiative — without the firm needing EU authorisation. This is known as "reverse solicitation."

Conditions for reverse solicitation: - The customer must initiate the contact — the firm must not have solicited the customer through marketing, advertising or outreach - Each transaction must be genuinely initiated by the customer — a single instance of reverse solicitation does not create a blanket permission for all future business with that customer - The firm must not market or advertise its services in the EU

Regulatory scrutiny: EU regulators — particularly ESMA and national competent authorities — have increasingly scrutinised reliance on reverse solicitation. The European Commission's 2024 guidance clarified that: - Maintaining a website accessible from the EU does not automatically constitute solicitation, but websites specifically designed to attract EU customers (e.g., EU-specific pricing, EU language options, EU regulatory disclaimers) may undermine a reverse solicitation claim - Attending conferences, publishing thought leadership or maintaining an EU social media presence may be considered solicitation depending on the context - Firms that generate a significant proportion of revenue from EU customers through purported reverse solicitation face heightened scrutiny

Practical limitations: Reverse solicitation is a narrow exception — not a business strategy. It may be appropriate for occasional, genuinely client-initiated transactions but cannot sustain a systematic EU business. Firms relying on reverse solicitation should maintain comprehensive records demonstrating that each client relationship was initiated by the customer.

Option 4: Contractual and Outsourcing Arrangements

Some UK firms have explored arrangements where an EU-authorised entity acts as the regulated "front end" for EU customers, while the UK firm provides outsourced services (portfolio management, technology, compliance support) under an outsourcing agreement.

This model can work but is subject to significant constraints: - The EU entity must have genuine decision-making authority — it cannot be a "letter box" that rubber-stamps decisions made in London - Outsourcing arrangements must comply with the relevant EU outsourcing guidelines (EBA, ESMA or EIOPA depending on the sector) - Critical or important functions outsourced to a third-country entity are subject to enhanced oversight requirements - National regulators may impose additional conditions on outsourcing to UK firms, reflecting the loss of the EU supervisory framework

The UK's Position: Overseas Persons Exemption

While this guide focuses on UK firms accessing EU markets, it is worth noting the UK's approach to inbound access. The UK maintains an "Overseas Persons Exclusion" (OPE) that allows certain non-UK firms to deal with UK clients without FCA authorisation, subject to conditions. The OPE has been reformed post-Brexit through the Financial Services and Markets Act 2023, with a new framework expected to provide more structured access for overseas firms wishing to serve UK customers.

Strategic Considerations

Timeline and cost: Establishing an EU subsidiary typically takes 6–18 months and involves significant legal, regulatory and operational costs. Firms should budget for: - Regulatory advisory fees: €50,000–€200,000+ - Local staffing and office costs: varies significantly by jurisdiction - Regulatory capital: depends on the authorisation type (€125,000 for PIs to €5 million for banks) - Ongoing compliance and supervision costs

Regulatory arbitrage risks: The EBA and national regulators are vigilant against firms that seek authorisation in the most permissive jurisdiction with the intention of passporting into jurisdictions with higher standards. Firms should choose a jurisdiction based on genuine operational and commercial factors — not merely the speed or ease of authorisation.

Future developments: UK-EU financial services cooperation remains subject to ongoing political negotiation. The Memorandum of Understanding on financial services regulatory cooperation (signed in June 2023) provides a framework for dialogue but has not yet resulted in significant market access improvements. Firms should plan on the basis that the current fragmented landscape will persist for the medium term.

Practical Recommendations

Assess your EU revenue and client base. If EU revenue is material, establish a properly authorised subsidiary. If EU revenue is minimal or incidental, reverse solicitation may be sufficient in the short term — but monitor regulatory developments closely.

Choose your jurisdiction carefully. Consider not just speed of authorisation but long-term supervisory relationship, substance requirements, tax implications and the jurisdiction's reputation across the EEA.

Build genuine substance. Whatever jurisdiction you choose, invest in genuine local presence. Regulators across the EU are increasingly rigorous in assessing substance, and a "brass plate" entity creates long-term supervisory and reputational risk.

Maintain flexibility. The post-Brexit regulatory landscape continues to evolve. Build your EU structure with sufficient flexibility to adapt to new equivalence decisions, regulatory changes or shifts in your EU business strategy.