Triangular passporting under MIFID II | New ESMA guidence on supervision, notifications and investor protection

SÉRVULO PUBLICATIONS 22 Jul 2026

On 7 July 2026, the European Securities and Markets Authority (“ESMA”) published a supervisory briefing on triangular passporting under MiFID II. The document aims to promote a more consistent and harmonised approach among national competent authorities (“NCAs”) in the supervision of cross-border structures for the provision of investment services.

Although this model is not new, ESMA’s clarifications are relevant for entities operating across several Member States, particularly through branches or tied agents. The briefing does not create new legal obligations and is not subject to a comply or explain mechanism, but it sets out supervisory expectations that should be taken into account when structuring these models.

 

1. Background

Triangular passporting occurs where an entity authorised in one Member State uses a branch or tied agent established in another Member State, under the freedom of establishment provided for in Article 35 of MiFID II, to provide investment services to clients located in a third Member State, under the freedom to provide services, pursuant to Article 34 of MiFID II.

This would be the case, for example, where an investment firm authorised in Portugal intends to use a branch or tied agent established in Spain to provide investment services to clients located in France.

ESMA acknowledges that these structures may respond to legitimate commercial and operational needs, including geographical, linguistic or cultural proximity, the centralisation of certain functions, regional expansion or greater efficiency in the provision of cross-border services.

Although MiFID II does not expressly regulate triangular passporting, ESMA confirms that the practice is not, in itself, prohibited. However, it also notes that these models may give rise to increased supervisory, investor protection and regulatory compliance risks, particularly where the activity involves more than two jurisdictions.

The key point is that a branch does not have separate legal personality or its own authorisation, and a tied agent acts under the full and unconditional responsibility of the authorised entity. For this reason, passporting rights always belong to the authorised entity in its home Member State, and not to the branch or tied agent.

 

2. Underlying rationale

ESMA stresses that triangular passporting should not be used to circumvent applicable supervision, benefit from more favourable regulatory practices or create forum shopping structures — that is, choosing a particular jurisdiction or regulatory structure not for substantive operational or commercial reasons, but to benefit from a supervisory approach perceived as more flexible or less demanding.

Accordingly, an entity authorised in Portugal should not, for example, establish a branch in Spain solely to provide services to clients in France if the purpose of that structure is to avoid applicable supervision or benefit from a more favourable regulatory approach.

Entities intending to rely on this model should ensure that the passporting notification accurately reflects how the services will be provided. In particular, where services into Member State C are to be provided through a branch or tied agent established in Member State B, this should be notified to the NCA of the home Member State as part of the freedom to provide services notification, which may be accompanied by a cover letter identifying the relevant branch or tied agent.

In addition, where an entity has already submitted a passporting notification to provide cross-border services and subsequently changes its operational organisation in order to rely on triangular passporting, it should update that notification with the NCA of the home Member State. For example, if an entity authorised in Portugal was already providing services directly to clients in France, but then starts providing those services through a branch or tied agent in Spain, that change should be reflected in an updated notification.

ESMA also expects entities to carry out an internal assessment of the risks associated with this model, including investor protection, anti-money laundering and counter-terrorist financing, outsourcing, third-party and cross-jurisdictional coordination risks. In the case of tied agents, appropriate prior assessment and ongoing monitoring mechanisms should also be in place.

 

3. Client information and complaints handling

Entities should also clearly inform clients in the third Member State that the services are provided through a branch or tied agent established in another Member State.

For example, if an entity authorised in Portugal provides services to clients in France through a branch in Spain, French clients should be informed that the service is provided by the Portuguese entity through its presence in Spain.

Clients should also be informed of the authority responsible for supervising the services provided. As a rule, that responsibility will lie with the authority of the home Member State of the authorised entity — in the example above, the Portuguese authority — and not necessarily with the authority of the Member State where the branch or tied agent is established.

ESMA also expects clients to be able to submit complaints free of charge either to the head office of the authorised entity or to the branch or tied agent through which the services were provided. Complaints should be integrated into the entity’s internal complaints-handling procedures and may be submitted in any language used in the marketing communications or contractual documentation addressed to those clients.

 

4. Supervisory responsibilities

The NCA of the home Member State is responsible for supervising the organisational requirements of the authorised entity, including in relation to any branch or tied agent located in another Member State. It also remains responsible for supervising services provided on a cross-border basis, even where those services are provided through a branch or tied agent established in another Member State.

By contrast, the NCA of the host Member State — where the branch or tied agent is established — is responsible for supervising the conduct-of-business rules applicable to services provided in that Member State.

Cooperation between authorities will therefore be essential to avoid supervisory gaps in structures involving several jurisdictions.

 

5. Practical impact

The briefing is particularly relevant for investment firms, credit institutions providing investment services, financial groups with a presence in several Member States and entities relying on networks of tied agents.

In practice, these entities should consider reviewing their passporting notifications, agreements with tied agents, client documentation, complaints-handling procedures, internal risk assessments and monitoring arrangements for branches and tied agents.

For entities authorised in Portugal that provide investment services in other Member States, or for foreign entities using branches or tied agents established in Portugal to provide services to clients in other EU markets, the document may be relevant to how the CMVM and other competent authorities assess the adequacy of passporting notifications, the clarity of client information and the robustness of internal controls associated with these cross-border models.

 

Verónica Fernández | vf@servulo.com