The EU Capital Requirements Directive (CRD) and the EU Capital Requirements Regulation (CRR) can be considered the core of European banking regulation. In 2024, following many years of discussions between the EU Commission, the EU Council and the EU Parliament, the sixth major amendment to the CRD (CRD VI) and the third major amendment to the CRR (CRR III) were finalized. While CRR III is intended to finalize implementation of the Basel III standard, the new CRD VI rules will introduce, for the first time, a harmonized framework for EU branches of banks incorporated and regulated in non-EU countries. CRD VI refers to these types of branches “third-country branches.” 

In this client alert we focus on the new provisions on cross-border banking services and summarize which services and credit institutions are affected, with information on certain exemptions and grandfathering rules. We also indicate what options are available to affected third-country enterprises for continuing to offer their services in the EU.¹

New provisions on cross-border banking services and third-country branches

Status quo

One key element of the CRD VI reform is the harmonization of rules for EU branches of banks incorporated and regulated in non-EU countries. Cross-border services from third countries are currently not fully harmonized. Thus, there are different rules among Member States that apply to the requirement to establish a branch and obtain a license in the EU when a third-country enterprise provides banking services to EU clients. The new provisions will harmonize those requirements, by introducing minimum requirements that third-country enterprises will have to observe when they intend to do business with EU customers. Member states may still apply stricter standards. 

Third-country enterprises currently have different options of providing services to clients and counterparties in the EU:

1. Establishment of a subsidiary (i.e., a separate legal entity) in a Member State, which requires obtaining a license in that Member State. The license grants “passporting rights” to provide services across all Member States. This means that if the subsidiary has been authorized in one Member State, it can offer its services in other Member States (either on a cross-border basis or by establishing a branch) without the need to obtain additional authorization in that Member States.
2. Establishment of branches in one (or more) EU Member State. Unlike a subsidiary, a branch is not a separate legal entity, but a mere establishment of the third-country enterprise. But in this case, a license is required in each Member State where the third-country enterprise establishes a branch, because the aforementioned “passporting rights” are not available to branches. 
3. Provision of cross-border services to customers in EU Member States on the basis of the so-called “reverse solicitation exemption.” This means that the third-country enterprise can provide cross-border banking services to customers in an EU Member State, as long as it does not solicit clients in that Member State but only responds to inquiries from clients.
4. Additional exemptions may be available under the local law of the relevant Member State. For example, in Germany, a third-country enterprise can obtain a waiver from the licensing requirement, allowing it to solicit potential customers in Germany.

However, the legal framework for such access to the EU market has yet to be fully harmonized. This applies in particular to the types of market access referred to in items b) to d) above. The extent to which third-country enterprises can provide services to customers in an EU Member State therefore depends on the domestic law of the particular Member State. This makes it a challenge for third-country enterprises to access the EU market. They must consider the domestic law of each Member State where they may have clients—even if they offer their services on only a cross-border basis, i.e. without setting up a branch or subsidiary in that Member State. 

Requirement to establish an authorized branch in a Member State

Article 21c CRD VI generally prohibits third-country enterprises from providing “core banking services” in the EU if they have not established a licensed branch in the EU. This will limit the options for third-country enterprises that haven’t established a licensed branch (or subsidiary) in the EU in providing banking services to EU customers For example, in Germany, third-country enterprises may obtain a waiver from the licensing requirements if they are subject to banking regulation that is comparable to EU and German standards in their home countries. Banks from the US, Canada, Switzerland, Japan and many other countries have relied on such waivers. Under CRD VI, the scope of such waivers will have to be narrowed down if the services provided include core banking services. 

Moreover, unless they can benefit from grandfathering, EU branches of third-country enterprises that are already established and licensed under the applicable domestic law of the Member State may have to apply for a new license under the CRD VI rules.

Under the new rules, “core banking services” include: 

1. Accepting deposits and other repayable funds;
2. Lending, including, for example, consumer credit, credit agreements relating to immovable property, factoring with or without recourse, financing of commercial transactions (including forfeiting); and
3. Provision of guarantees and commitments.

Originally, the Commission had proposed a much broader ban on the provision of cross-border services, but during the legislative process, the scope was limited to the services mentioned above.

With respect to deposit business, the requirement to establish a third-country branch applies to all types of third-country enterprises while, for the cross-border lending and guarantee business, only the following third-country enterprises will be in scope of the new rules:

1. Third-country enterprises that would qualify as credit institutions under the CRR if they were established in the EU, because they provide deposit and lending services.
2. Third-country enterprises that deal on own account or provide underwriting services, provided that they
   1. hold assets of €30 billion or more; or
   2. are part of a group that includes entities that deal on own account or underwrite financial instrument, and either (x) such group entities hold assets of €30 billion or (y) the competent authority decides to regulate them as a credit institution. 

Not included in the scope are insurance undertakings, commodity dealers and funds.

Regulatory framework applicable to third-country branches

CRD VI contains certain minimum regulatory requirements that Member States must apply to third-country branches. These include requirements for authorization, regulatory capital, liquidity and reporting. However, a Member State may apply stricter rules. This means in particular that Member States can apply the same regulatory requirements to third-country branches that apply to credit institutions incorporated in their jurisdiction.

Requirements for authorization of a branch

CRD VI sets out minimum requirements that a branch must meet in order to be authorized. These include, for example, capital requirements. In addition, the activities of the branch must be covered by the authorization that the head office holds in the third country where it is incorporated and supervised. In addition, it must be ensured that the competent supervisory authority of the Member State where it is established is able to access all necessary information about the head undertaking from the supervisory authorities of that head undertaking, and it must be able to effectively coordinate its supervisory activities with those of the third-country’s supervisory authorities. To this end, the supervisory authorities may enter into cooperation agreements with the supervisory authorities of third countries.

However, a Member State may apply stricter requirements to branches in its territory. This includes requiring third-country enterprises to establish a subsidiary, rather than a branch. The circumstances under which a Member State can require a third-country enterprise to establish a branch are not fully harmonized and thus can differ. What is the same among all Member States, however, is that they must endow their national competent authorities with the right to require a third-country enterprise to establish a subsidiary in the following circumstances: 

1. The third-country enterprise has already established a branch in the relevant Member State and the branch has provided—in the past or is currently providing—core banking services to customers in other Member States; or
2. The third-country branch is systemically important and poses significant financial stability risks in the EU or in the Member State where it is established; or
3. The aggregate amount of the assets of all third-country branches in the EU which belong to the same third-country group is equal to or greater than €40 billion, or the amount of the third-country branch’s assets on its book in the Member State where it is established is equal to or greater than €10 billion.

Such subsidiary must apply for authorization and will be subject to the general regulatory requirements that apply to banks established in such Member State.

Classification of third-country branches

With respect to the regulatory requirements that apply to third-country branches, CRD VI distinguishes between class 1 third-country branches, class 2 third-country branches and qualifying third-country branches.

A third-country branch qualifies as a class 1 branch if it meets any of the following conditions:

1. The total value of the assets booked or originated by the third-country branch in the relevant Member State is equal to or greater than €5 billion, as reported for the immediately preceding annual reporting period; 
2. The third-country branch’s authorized activities include taking deposits or other repayable funds from retail customers, provided that the amount of those deposits and other repayable funds is equal to or greater than 5 percent of the total liabilities of the third-country branch or the amount of such deposits and other repayable funds exceeds €50 million; or
3. They are not qualifying third-country branches.

“Qualifying third-country branches” are third-country branches that meet the following conditions:

1. The head undertaking is established in a country that applies prudential standards and supervisory oversight in accordance with the third country’s banking regulatory framework that are at least equivalent to CRD VI and CRR III;
2. The supervisory authorities of the head undertaking are subject to confidentiality requirements that are at least equivalent to the requirements laid down in CRD VI; and
3. The head undertaking is established in a country that is not listed as a high-risk third country that has strategic deficiencies in its anti-money laundering and counter-terrorist financing regime (Article 9 of Directive (EU) 2015/849).

Class 2 branches are those third-country branches that are not class 1 third-country branches or qualifying third-country branches.

Regulatory capital requirements

The amount of the minimum capital for third-country branches depends, among other things, on whether the third-country branch qualifies as a “class 1 branch” or as a “class 2 branch”. The minimum capital requirements are:

1. For class 1 third-country branches: 2.5 percent of the branch’s average liabilities for the three immediately preceding annual reporting periods or, for newly authorized third-country branches, of the branch’s liabilities at the time of authorization, subject to a minimum of €10 million; and
2. For class 2 third-country branches: 0.5 percent of the branch’s average liabilities for the three immediately preceding annual reporting periods or, for newly authorized third-country branches, of the branch’s liabilities at the time of authorization subject to a minimum of €5 million.

Reporting requirements for third-country branches

Third-country branches will have to periodically report information to the competent authority of the Member State where it is established. Such reports include the following information:

1. The assets and liabilities held on their books and the assets and liabilities originated by the third-country branches, with a breakdown that singles out:
   1. the largest recorded assets and liabilities classified by sector and counterparty type, including, in particular, financial sector exposures,
   2. significant exposure and funding source concentrations to specified types of counterparties,
   3. significant internal transactions with the head undertaking and with members of the head undertaking’s group;
2. Proof of the third-country branches’ compliance with the requirements that apply to them under CRD VI;
3. (On an ad hoc basis), the deposit protection arrangements available to depositors in the third-country branches;
4. Additional regulatory requirements imposed on the third-country branches by Member States under national law.

In addition, third-country branches will also have to report certain information about their head office.

Liquidity requirements

As a minimum liquidity requirement, third-country branches must maintain at all times a volume of unencumbered and liquid assets sufficient to cover liquidity outflows over a minimum period of 30 days. However, Member States may establish additional requirements. In addition, class 1 third-country branches must comply with the liquidity coverage requirements under the CRR.

Booking requirements

Third-country branches must maintain a registry book with precise records of all the assets and liabilities booked or originated by the third-country branch. Those assets and liabilities must be autonomously managed within the third-country branch. Third-country branches must have a booking policy with a clear rationale for the booking arrangements.

What are the exemptions?

The restriction on cross-border core banking services is subject to various exemptions, in particular regarding:

• Interbank transactions (i.e. services provided to other banks or CRR investment firms),
• Intragroup transactions,
• Reverse solicitation,
• Services ancillary to MiFID services (although the scope of this carve-out is not entirely clear, it appears that deposit taking and granting credit or loans provided solely for the purposes of supporting MiFID activities will be out of scope of the new provisions).

Grandfathering rules

Third-country enterprises that already provide core banking services on a cross-border basis may rely on a grandfathering rule, but the scope of the grandfathering rule is rather limited. The new requirements do not apply to contracts on core banking services that are entered into before 11 July 2026. It is unclear whether the grandfathering still applies if significant changes to existing contracts are made.

Grandfathering is also available to third-country branches that have been licensed under the domestic law of a Member State by 10 January 2027. However, this grandfathering is at the discretion of the supervisory authority of the relevant Member States. It may only be granted if under the applicable law of the relevant Member State, such branches already have to comply with requirements that are equivalent to the requirements that apply to third-country branches under CRD VI. 

What are the options for continuing business?

With the introduction of the new provisions and, in particular, the restriction on providing cross-border services, it is essential to know what options are available for credit institutions that intend to continue providing services to EU customers.

First, third-country enterprises currently providing cross-border banking services will need to consider the extent to which their activities (e.g. lending, providing guarantees and commitments) fall within scope of the new requirements. They should consider whether they can rely on any of the exemptions (in particular, the intra-group and interbank exemptions) and whether reliance on reverse solicitation is feasible given its limitations. Third-country enterprises that currently rely on cross-border waivers (e.g. in Germany) should expect that these may no longer apply once the new provisions come into force. 

Second, third-country enterprises can establish third-country branches in the Member States where they do business. Compared to relying on the reverse solicitation exemption as set out above, such third-country branch can solicit customers in the Member State where it is established. In addition, it only has to comply with the regulatory requirements that apply to third-country branches in the Member State where it is established. These requirements are less stringent than the requirements that apply to fully authorized banks. However, the disadvantage of establishing a third-country branch is that such branches cannot rely on the EU passport for financial services. This means that a third-country branch established in one Member State cannot provide core banking services to customers in other Member States. Therefore, third-country enterprises doing business in more than one Member State may be required to establish a third-country branch in every Member State where they do business. 

Third, the third-country enterprise can establish a subsidiary in one Member State. If the subsidiary becomes authorized in that Member State, it can provide core banking services in all other Member States under the EU passport for financial services. However, that subsidiary would qualify as an EU credit institution. It must therefore comply with all regulatory requirements that apply to EU credit institutions. 

Timeline and outlook

CRD VI was published in the Official Journal on 19 June 2024. Member States will have 18 months to implement the new CRD VI provisions into national law, i.e. they will have to apply the new rules from 11 January 2026. The new restrictions on cross-border services and the supervision requirements regarding third-country branches will have an additional transition period of 12 month before they come into force. Although this means the new provisions will not become applicable until 11 January 2027, affected third-country enterprises and third-country branches should start evaluating the impact and limitations of their cross-border services at an early stage in order to prepare for the new provisions.

In addition, the EBA will develop draft regulatory technical standards (RTS) and guidelines that will specify the information to be provided to supervisors and other aspects of CRD VI.

1. Please note that in this article, unless noted otherwise “EU” or “Member States” also includes Norway, Iceland and Lichtenstein, where CRD and CRR also apply.↩