On 23 July 2025, the European Banking Authority (EBA) published a Report on the direct provision of banking services from third countries.
As mandated by article 21c(6) Capital Requirement Directive (CRD) the EBA, in consultation with the European Securities and Markets Authority (ESMA) and the European Insurance and Occupational Pensions Authority (EIOPA) developed a Report to assess whether it is appropriate to extend the possibility for third-country undertakings (TCUs) to provide core banking services directly from third countries (i.e. without a branch in the European Union) not only to EU credit institutions, but to any EU financial sector entity (FSE).
For the purposes of the report, FSEs include EU-based investment firms, asset management companies, insurance and reinsurance undertakings, payment institutions, e-money institutions, issuers of asset-referenced tokens and crypto-asset service providers.
The EBA outlined that several factors make it difficult to measure the impact of the prohibition of direct services from third countries set out in Article 21c CRD and highlighted that, at the same time, Article 21c of the CRD provides flexibility to EU financial sector entities that remain free to solicit core banking services from TCUs or may rely on services provided by third country branches or subsidiaries in the EU.
The EBA's analysis did not lead it to recommend the amendment of the new Article 21c of CRD, which identifies how core banking services should be provided in a Member State.
However, the EBA suggests that authorities and market participants could benefit from a clarification of the interaction between Article 21c of the CRD and other sectorial legislations.
For example, the EBA notes that Article 21c CRD does not expressly address the interaction with the Undertakings for the Collective Investment in Transferable Securities (UCITS) and the Alternative Investment Fund Managers Directive (AIFMD), in particular those provisions entitling EU financial sector entities to receive core banking services for their ongoing operationality in third countries in accordance with their business model. The EBA suggests that additional clarification could also be provided via the EBA Q&A tool.
Background
There is currently no harmonised regime in the European Economic Area (EEA) in relation to the provision of cross-border banking business from third countries.
Under current rules, TCUs (typically banks) can provide certain financial services in the EEA by way of:
- Subsidiarisation – establishing a licensed subsidiary in a Member State, which can provide services across the EU through acquired passporting rights.
- Third country branch – establishing a branch in one or more EU Member States, which does not acquire passporting rights.
- Reverse solicitation – providing services under a reverse solicitation exemption (i.e. as a response to service inquiries).
- Member State exemption – relying on local exemptions at the Member State level.
In Ireland, wholesale lending (i.e. where the lending is not to a natural person) does not require authorisation from the Central Bank of Ireland, the national competent authority (NCA). Therefore, a third country bank that wishes to engage in wholesale lending into Ireland on a cross-border basis, or to establish a branch office in Ireland for that purpose, does not need authorisation from the Central Bank of Ireland.
CRD VI – Changes to the third-country branch regulatory regime
The way in which non-EEA entities provide cross-border banking services into Member States will be significantly impacted by the new restrictions for cross-border lending and core banking business introduced by the latest version of the CRD, set out in amending Directive (EU) 2024/1619 (CRD VI), which came into effect on 9 July 2024.
Article 1(9) of CRD VI introduces a new Article 21(c)(1) into the CRD, which will effectively prohibit third-country banks from providing "core banking services" in a Member State without establishing a branch there.
CRD VI heralds significant changes to the third-country branch regulatory regime and will impact non-EU banks or qualifying credit institutions providing certain services in EU Member States.
The directive currently remains to be transposed in Ireland. The transposition of this new regime must occur by 10 January 2026 and the Irish Government has already held a public consultation on how certain discretions allowed to Member States in the Directive should be exercised. The provisions of CRD VI specific to third-country branches are to be applied from 11 January 2027.
What is changing?
CRD VI introduces new EU-specific requirements that:
- harmonise the provision of "core banking services";
- harmonise the exemptions and carve outs to the third country branch provisions;
- set out minimum authorisation requirements for third-country branches; and
- permit NCAs to require third-country branches to apply for authorisation as a subsidiary in certain circumstances.
When CRD VI becomes operative in 2026 and 2027, EU Member States will require relevant undertakings established in a country outside the EU to establish a branch in their territory and apply for authorisation from the NCA to carry on "core banking activities" in the relevant Member State.
TCUs that had previously relied on exemptions under Member State local laws to do business in specific EU Member States will no longer be able to do so for the services captured by the new rules unless they fall within an exemption or carve out under CRD VI.
CRD VI allows for Member State discretion in relation to the application of requirements for third-country branches authorised in their territory. For instance, Member States can opt to apply to third-country branches authorised in their territory, or to certain categories thereof: (i) the same requirements that apply to credit institutions authorised under the CRD or (ii) the branch-specific requirements applicable to all third country branches.
These changes will be significant to TCUs carrying on core banking activities in the EU. It will likely lead some affected entities to consider alternative options to authorisation as a branch such as establishing an EU credit institution, which would enable them to passport services within the EU.
Core banking services
"Core banking services" under Article 21c of CRD VI include:
- Accepting deposits and other repayable funds.
- Lending, including consumer credit, credit agreements for real estate, factoring (with or without recourse), and financing commercial transactions (including forfeiting).
- Offering guarantees and commitments.
Exemptions and carve outs
The following exemptions and carve outs set out in CRD VI may be available to TCUs depending on the circumstances:
- Reverse solicitation: the requirements of CRD VI will not apply where the client or counterparty approaches the TCU exclusively on its own initiative.
- Interbank business or services: the CRD VI requirements will not apply where the TCU provides services to another "credit institution".
- Intergroup business or services: intergroup transactions are not covered by CRD VI.
- MiFID II business and ancillary services: the CRD VI requirements will not apply to banking activities that also qualify as MiFID II services or activities listed under Annex I, Section A, to Directive 2014/65/EU, as well as ancillary services such as granting credits or loans to provide these services.
- Grandfathered contracts: CRD VI provides that Member States can preserve a client's acquired rights under existing contracts entered into before 11 July 2026 (although the exact scope of this exemption has yet to be determined).
Minimum authorisation requirements
Under current rules, EU Member States have broad discretion in determining rules for authorising and supervising third-country bank branches, provided they do not treat them more favourably than EU credit institutions.
Under CRD VI, third-country branches will become subject to minimum EU requirements, including capital, liquidity, and internal governance requirements.
Member States have the option to impose more rigorous requirements on banking services provided by TCUs.
Affected TCUs that already have branches in the EU may be subject to more stringent requirements than they are currently subject to.
NCA role
The NCAs of each EU Member State can impose additional requirements where systemic risks arise or certain thresholds are exceeded, including to require TCUs to establish a subsidiary in certain circumstances (instead of a branch).
Under the new harmonised rules, NCAs will also have the power to require TCUs to apply for authorisation of a branch if they wish to continue providing these services in the relevant Member State.
Next steps
The changes under CRD VI will mainly affect commercial lending into the EU. TCUs providing or intending to provide these services will have to consider how they do business in the EU in the future and what form their presence in an EU Member State should take. Affected TCUs can consider the following actions:
- Review global cross-border banking business model to establish which business lines are in scope of the new restrictions under CRD VI.
- Establish whether any exemptions under Article 21c CRD VI can be relied on to enable the undertaking to continue or conduct business in the EEA.
- Review current EEA business model.
- Consider establishing a third country branch or subsidiary.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
