EU passporting for payment, e-money and crypto firms

A passport exists only where an EU law harmonizes the license. The law firm CMS names MiFID II, the Capital Requirements Directive and the Insurance Distribution Directive as sources of passporting rights; for payments the source is PSD2 together with the E-Money Directive, and for crypto-assets MiCAR. A firm uses it in one of two ways: it opens a branch in the host state, or it serves customers there across the border. Payment institutions can also work through agents in the host state.

The home supervisor stays in charge. It receives the notification, checks it and forwards it to the host supervisor, and it keeps supervising the firm as a whole. The host supervisor can raise concerns about money laundering or consumer protection and act against a branch in urgent cases.

Under Article 28 of PSD2 the home authority forwards a complete notification to the host authority within one month and decides within three months whether to register the branch or agent. In Germany section 38 of the ZAG carries this for German institutions going abroad: they notify BaFin and the Bundesbank with the host state, a business plan and the details of any agents, and they may start once the branch or agent is in the register.

For firms coming in, section 39 allows an institution licensed in another EEA state to provide payment services or e-money business in Germany without a BaFin license, through a branch, agents or cross-border services. BaFin assesses the information from the home authority within one month and may ban new business where a firm puts German payment users at serious risk and its home authority does not act. The ZAG page covers the rest of the law.

MiCAR sets the shortest notice period. Under Article 59 a licensed crypto-asset service provider may provide its services throughout the Union without a physical presence in the host states. Under Article 65 of MiCAR it tells its home authority in which states it will work and from when; the authority forwards this within ten working days, and the provider may start at the latest on the 15th calendar day after its submission.

Stablecoin issuers need a license that carries its own passport: an issuer of an e-money token must be a credit institution or an e-money institution, according to recital 66 of MiCAR.

A firm can also serve a third country through a branch in a second one, for example a bank licensed in France that serves German customers from a branch in Ireland, as CMS describes. EU law neither covers nor bans this structure. The EBA expects the notification to go from the home authority to the authority of the state where the customers are, and the payments reform under PSD3 is meant to settle the question for payment institutions.

The right of a firm licensed in one EU or EEA state to offer the same regulated services in the other member states, through a branch or across the border, after a notification to its home supervisor and without a second license.

Not for the services its home license covers, once it has passported them into Germany. BaFin keeps powers over branches and agents in Germany, and German trade law still applies. Services outside the home license need their own authorization.

Under PSD2 the home authority forwards the notification within one month and decides on a branch or agent within three months. Under MiCAR a crypto-asset service provider may start at the latest on the 15th calendar day after it informed its home authority.