Passporting
Passporting is the right of a financial firm authorised in one European Economic Area country to serve customers in the others under its home licence, by notifying its home regulator rather than seeking local licences. It exists licence by licence — banking, investment services, payments, e-money, funds, insurance — and UK firms lost it at the end of 2020.
- Also known as
- Passporting rights, EU passport, Single market passport, Financial services passport
- Used by
- banks, investment firms, payment and e-money institutions, fund managers and insurers expanding across the EEA's 30 countries; MiCA extended single-licence access to crypto-asset service providers
- Binding
- written into each sectoral law — the Capital Requirements Directive for banks, MiFID II for investment firms, PSD2 for payment institutions, and the E-Money Directive, which applies the PSD2 procedure to e-money institutions and their distributors
- Two routes
- providing services cross-border from the home country, or establishing a branch; payment and e-money firms can also passport through agents and distributors
- Typical timeline
- for a payment institution, the home regulator forwards a complete notification within one month, the host regulator has a month to raise concerns such as money-laundering risk, and a branch or agent decision follows within three months; for banks, a services notification is forwarded within one month
- Outside the EEA
- no third country has passporting rights; EEA firms' passports into the UK ended with the Brexit transition on 31 December 2020, followed by a temporary permissions regime that closed on 31 December 2023
- Parties
- the firm, its home regulator (which authorises and supervises it), the host regulators, and the customers in each market
How passporting works in practice
A fintech authorised as an e-money institution in one EU state that wants customers in France and Spain files a passport notification with its home regulator, naming the countries, the services and the route: cross-border services, a branch, or agents and distributors. The home regulator forwards it to each host regulator, and once the procedure is complete the firm can onboard customers there without a local licence. One authorisation, one capital requirement, one safeguarding regime and one lead supervisor then cover the whole market.
The simplicity has limits. Local consumer-protection, marketing, tax and language rules still apply; a host regulator can object to an agent or branch on money-laundering grounds; and the home regulator's view of the firm now travels everywhere, so a restriction at home is a restriction in every host country.
Brexit showed what the passport is worth. From 1 January 2021 UK-authorised firms needed an authorisation in an EEA state, usually through a subsidiary, to keep serving EU customers, and EEA firms needed UK permission to stay in Britain.
In an acquisition the passports belong to the licensed entity. A share purchase keeps them, subject to the regulator approving the new controller; an asset purchase does not, and the buyer's own licence must already carry the passports it needs. Diligence lists every notification, maps where the firm actually has customers, and checks that activity has not gone beyond what was notified.
Example
A UK payments company loses its EU access at the end of 2020 and obtains an e-money licence in an EU member state for a new subsidiary: €350,000 of initial capital, a local management team and 11 months of application work. The subsidiary then passports into 14 EEA countries by notification, each cleared in six to ten weeks. Four years later a buyer offers £140m for the group. Diligence finds the subsidiary serving customers in two countries it never notified — 6% of its EU volume — and an agent network in a third that was never registered. Completion is made conditional on the home regulator approving the change in control and on remedial notifications, and £5m is held in escrow against regulatory findings.
Common mistakes
- Assuming a passport covers every service; it covers only what the home licence permits and the notification names. - Onboarding customers in a new country before the notification procedure is complete. - Planning an asset purchase of a licensed business and expecting the passports to follow. - Overlooking host-country consumer, marketing and language rules, which still apply. - Treating an equivalence decision as a passport; it gives firms from outside the EEA much narrower access. - Forgetting that a finding by the home regulator now affects every host market at once.