From January 11, 2027, Article 21c of Directive 2013/36/EU — the Capital Requirements Directive (CRD), as amended by CRD VI, Directive (EU) 2024/1619 — prohibits third-country banks from taking deposits, lending or issuing guarantees to clients in an EU member state without an authorised branch in that state, leaving reverse solicitation as the only surviving cross-border route and drafting it so narrowly that no firm can build a book on it.

The European Banking Authority (EBA) closed the last open piece of the framework on July 7, 2026, publishing final Guidelines EBA/GL/2026/08 on the authorisation of third-country branches under Article 48c(8) of the CRD. Those guidelines apply from the same date as the regime itself: January 11, 2027. The transposition deadline for member states was January 10, 2026, and on March 27, 2026 the European Commission sent letters of formal notice to 22 of the 27 member states for failing to notify full transposition. This analysis sets out what Article 21c actually captures, the asymmetry between deposit-taking and lending that most commentary skips, how five national transpositions already diverge, and what the enforcement record suggests happens to firms that get the analysis wrong.

Key facts

• Application date: January 11, 2027 for the third-country branch (TCB) regime and for EBA/GL/2026/08 (EBA Final Report, July 7, 2026, page 4).
• Transposition deadline: January 10, 2026. On March 27, 2026 the Commission issued letters of formal notice to 22 member states — including Germany, France, Ireland, Luxembourg and the Netherlands — for incomplete transposition, with two months to respond (Norton Rose Fulbright).
• Core banking services in scope: points 1, 2 and 6 of Annex I to the CRD — deposits or other repayable funds, lending, and guarantees and commitments (Article 47(1), points (a) and (b)).
• Grandfathering: Article 21c(5) reporting obligations bit from July 11, 2026; contracts entered into before that date are grandfathered.
• Class 1 triggers: booked or originated assets of €5 billion or more; retail deposits at or above 5% of total liabilities or exceeding €50 million; a head undertaking in a high-risk anti-money laundering (AML) jurisdiction or a non-equivalent third country. Irish capital endowment is 2.5% of average liabilities with a €10 million floor for Class 1, 0.5% with a €5 million floor for Class 2 (William Fry).
• Forced subsidiarisation: aggregate assets of €40 billion across all TCBs of the same third-country group, or €10 billion booked in one branch, let a competent authority require authorisation as a credit institution under Title III, Chapter 1 CRD.
• Consultation response rate: the EBA’s three-month consultation on the authorisation guidelines, which closed on February 3, 2026, drew exactly one response, and it was confidential.

Methodology and sources

This analysis rests on four primary documents: the EBA’s Final Report on Guidelines on the authorisation of third-country branches (EBA/GL/2026/08, July 7, 2026); the EBA Report under Article 21c(6) CRD (EBA/REP/2025/21, July 2025), prepared with the European Securities and Markets Authority (ESMA) and the European Insurance and Occupational Pensions Authority (EIOPA); Directive (EU) 2024/1619 as published in the Official Journal; and the national transposing instruments for France, Luxembourg and Ireland. Secondary material is limited to named law-firm commentary. Jurisdictional scope is the EU-27 plus the most exposed third countries — the United Kingdom, United States and Switzerland. The window runs from the Official Journal publication of CRD VI in June 2024 to August 2026. Caveat: several member states had not completed transposition at the time of writing, so the national detail below is subject to change.

What Article 21c actually captures — and the asymmetry most firms miss

Article 21c does not say “no banking into the EU without a branch”. It says something narrower and stranger, and the difference decides whether a given firm is in scope at all. The EBA sets it out plainly in its Final Report: the entities caught are (a) head undertakings in a third country that, were they established in the Union, would meet the definition of credit institution in points (a) and (b) of Article 4(1)(4) of Regulation (EU) No 575/2013 — including investment firms above the €30 billion threshold that must be re-authorised as credit institutions — where they carry out the activities in points 2 and 6 of Annex I, namely granting loans and providing guarantees or commitments; and (b) any third-country undertaking taking deposits or other repayable funds under point 1 of Annex I.

Article 21c CRD splits third-country market access along the line between funding and deposits. Deposit-taking is caught whoever does it: a fintech, a commodity trader, a payments group or a bank that solicits repayable funds from an EU client without a locally authorised branch is in breach from January 11, 2027. Lending, guarantees and commitments are caught only where the provider would qualify as a credit institution, or as a large investment firm above the €30 billion consolidated-asset test, if it were established in the Union. Credit funds, insurance undertakings, commodity dealers and collective investment undertakings therefore fall outside the branch requirement for lending — the so-called non-bank carve-out. That carve-out is a scope exclusion under EU law, not a licence, and it says nothing about national lending regimes that operate independently of deposit-taking.

Four exemptions sit alongside the scope test. Services provided to EU credit institutions are exempt, as are intragroup arrangements with members of the same group in the Union, transactions grandfathered under contracts entered into before July 11, 2026, and services under Section A of Annex I to Directive 2014/65/EU (MiFID II) plus their ancillary services, which the CRD leaves untouched. The fourth is reverse solicitation. The EBA’s own report describes the effect: marketing activity by the third-country firm is incompatible with reverse solicitation, including in relation to “other categories of products, activities or services than those that the client or counterparty had solicited”, and the exemption is defeated where the firm solicits “through an entity acting on [its] behalf or having close links with such third country undertaking or through any other person acting on behalf of such undertaking”.

How five jurisdictions handle the same article

Jurisdiction / Regulator	Instrument and date	Scope	Key requirement	Sanction
EU baseline (EBA + national CAs)	Directive (EU) 2024/1619; EBA/GL/2026/08 of July 7, 2026; applies January 11, 2027	Third-country undertakings providing Annex I points 1, 2 and 6 services	Authorised branch in each member state; Article 48c(4) conditions including a non-opposition statement from the home supervisor	Refusal or withdrawal of authorisation under Article 48d; forced subsidiarisation under Article 48i
Ireland (Central Bank of Ireland)	S.I. No. 326 of 2026, signed July 10, 2026	All TCBs; Ireland declined the subsidiary-like discretion	Class 1: 2.5% of average liabilities, €10m floor. Class 2: 0.5%, €5m floor. 30-day liquid asset buffer held in Ireland	Authorisation refusal; Central Bank administrative sanctions procedure
France (ACPR)	Ordonnance n° 2026-255 of April 8, 2026 (JORF April 9, 2026); Décret n° 2026-309 of April 24, 2026	Overlays the pre-existing monopole bancaire, which already licensed most core banking activity	Article 21c exemptions expressly recognised; capital requirements made derogatory rather than default, requiring an individual ACPR decision	ACPR sanctions commission; withdrawal of agrément
Germany (BaFin)	CRD VI implementation act amending the Kreditwesengesetz (KWG)	Existing section 2(5) KWG licensing waivers for third-country firms fall away	Branch authorisation under the KWG; gold-plating stripped from the draft on market-access points	Section 37 KWG: order to cease business immediately and wind it up; repayment of funds taken
Luxembourg (CSSF)	Law of May 5, 2026	Materially rewrites the pre-CRD VI national branch regime	CSSF authorisation and prudential requirements aligned to Title VI CRD	CSSF administrative fines; withdrawal of authorisation
United Kingdom (PRA / FCA) — for contrast	No equivalent regime; UK firms are now third-country undertakings for EU purposes	UK banks lending or taking deposits into the EU	Must establish an EU branch or subsidiary, or rely on an Article 21c exemption	Sanction applied by the EU host-state authority, not the PRA or FCA

Sources: EBA/GL/2026/08; Directive (EU) 2024/1619; Légifrance; Herbert Smith Freehills Kramer; Morgan Lewis; William Fry. Last updated: August 21, 2026.

The table understates the divergence, because the directive is minimum harmonisation. Member states retain the option to treat a third-country branch exactly like a subsidiary of the head undertaking — the “subsidiary-like approach” the EBA flags in its Final Report — and they retain national lending regimes that sit outside the CRD perimeter entirely. Ireland declined the subsidiary-like discretion. France moved in the opposite direction on capital, converting the endowment requirement from a default into something the ACPR must impose case by case, a change French practitioners attribute to preserving the attractiveness of the Paris market. Germany’s amendment removes accommodations non-EU banks have relied on for years, most notably the section 2(5) KWG waiver route. A firm that maps its EU exposure at directive level and stops there will get the wrong answer in at least three of these five jurisdictions.

The territorial point compounds it. A third-country branch is authorised in one member state only and gets no passport; the EBA is explicit that breaching that territorial scope is itself a ground to trigger the subsidiarisation procedure under Article 48i. A US or UK bank with pan-European corporate clients therefore faces a multiplication problem: one branch per member state where it wants to lend, each with its own capital endowment, liquid asset buffer, local governance and reporting stack — or a single EU subsidiary with passporting rights and full credit-institution capital treatment.

“Reverse solicitation as a concept, is not new. We’ve seen it in the context of other regimes, but it is new in the Irish context for banking services.”

— Sarah Thompson, Partner and Head of Financial Regulation Group, Arthur Cox (Arthur Cox)

Thompson’s second point is the one lenders keep discovering late: grandfathering is fragile. On lifecycle events affecting protected agreements, she warns that “anything that’s materially changing about your agreement, you have to have a care as to whether you could potentially have a loss of grandfathering.” An amendment-and-restatement, an accordion increase, a new borrower acceding to a facility — each raises the question of whether the pre-July 11, 2026 contract survives as the same contract. Where it does not, the fallback is a new exemption, and in most structures the only candidate is reverse solicitation.

Enforcement context: what operating without the licence has cost so far

Article 21c creates no new sanctioning regime. It routes breaches into national unauthorised-business powers that already exist and are already used. Germany’s are the sharpest illustration. Under section 37 of the KWG, BaFin may order an undertaking and its officers to cease business immediately and wind it up. In an order dated May 5, 2026, published on May 22, 2026, BaFin directed Ventus Energy Group OÜ, domiciled in Tallinn, to cease and wind up the deposit business it had been conducting without authorisation, and to repay the accepted funds without delay. The conduct was mundane: loan contracts with investors in Germany under which funds were unconditionally repayable, which is deposit business within the meaning of section 1(1) sentence 2 no. 1 KWG. No branch, no marketing campaign, no retail app — just repayable funds taken from clients in a jurisdiction where the taker held no licence.

The financial penalties sit at the other end. On April 25, 2022, De Nederlandsche Bank (DNB) imposed a fine of €3,325,000 on Binance, announced on July 18, 2022, for offering services to Dutch clients without the registration Dutch law required. DNB’s reasoning transfers directly to Article 21c: the firm “has a very large number of customers in the Netherlands”, and operating unregistered meant a large number of unusual transactions stayed outside the view of the investigating authorities. The base penalty was €2 million, scaled up for seriousness and culpability against a €4 million maximum, then reduced by 5% in mitigation. Offshore incorporation and the absence of a local establishment were treated as the offence, not as a defence. Crowell & Moring’s London financial services team makes the same point about the branch requirement: the “regulatory consequences of lending without the required third-country branch authorisation may include fines, public censure and orders to cease business.”

Supervisors are hardening cross-border perimeter rules in parallel elsewhere, as the EU transaction ban imposed on 14 crypto platforms and FinCEN’s $125 million UBS order, which turned FX wire data into a Bank Secrecy Act duty, both show. The theory in each case is that serving clients in a jurisdiction creates obligations in that jurisdiction regardless of where the servicing entity sits.

What this means for brokers, banks, funds and compliance teams

For third-country banks and their EU-facing desks, the work is an entity-by-entity, product-by-product scope map completed well before January 11, 2027, because the authorisation clock is long. Under the EBA guidelines, competent authorities should finalise an assessment within six months of the start of the assessment period, or in any case within 12 months of receipt of the application — and the assessment period only starts once the file is complete. The application must carry a programme of operations, business plan, capital endowment evidence, liquidity plan, internal governance, booking arrangements, reporting capability mapped to EBA templates, head-undertaking prudential information, and a statement of non-opposition from the home supervisor. A firm starting the file in the fourth quarter of 2026 will not be authorised on day one.

For brokers, prime brokers and liquidity providers, the immediate question is whether any part of the offering is a core banking service dressed as something else. Margin lending, credit lines against collateral, guarantees issued to support client positions and cash held as unconditionally repayable client balances all invite the analysis. MiFID investment services and their ancillary services are carved out, so a pure execution or custody relationship is unaffected, though the EBA has flagged safekeeping-adjacent credit provision as the area where firms are asking for clarity. Anyone running a UK or offshore entity into EU professional clients should read this alongside the UK’s own perimeter tightening in CP26/23, which splits UK contracts-for-difference books into UK and non-UK clients.

For fund managers and non-bank lenders, the carve-out is real but narrow. Credit funds are outside Article 21c for lending, and the EBA declined in July 2025 to widen the interbank exemption to EU financial sector entities generally, so money market funds, alternative investment funds and investment firms are treated as clients rather than counterparties. The EBA’s own data show why it felt able to say no: cash exposures to third-country undertakings represent 1.72% of alternative investment funds’ total cash exposures and 0.94% of net asset value, and deposits with third-country undertakings account for 5.0% of EU investment firms’ own cash, with materiality concentrated in Ireland and Luxembourg rather than spread across the Union.

For legal and compliance teams, three artefacts matter most: a time-stamped record of who initiated each relationship and for which specific service; a grandfathering register listing every pre-July 11, 2026 contract with its amendment history; and a cross-selling control that stops relationship managers offering a product category the client never solicited. The last is where reverse solicitation dies in practice.

“Reliance on the non-bank carve-out requires careful, structure-specific analysis, and does not eliminate all regulatory risk.”

— Tom Dell’Avvocato, Partner, Financial Services Group, Crowell & Moring, London (FinTalk)

What’s next: the forward view

Three things are unresolved. The first is transposition. Twenty-two member states were on formal notice as of March 27, 2026 with two months to respond, and while Ireland, France and Luxembourg have since legislated, firms are building compliance programmes against national texts that in some states did not exist a quarter before the application date. Expect reasoned opinions and, in the slowest cases, referrals to the Court of Justice during 2027.

The second is interpretation. Neither Article 21c nor the national transpositions define “own exclusive initiative”. The EBA’s Final Report points market participants and competent authorities to ESMA’s existing material — the MiFID II investor-protection Q&As, ESMA’s January 2021 public statement on reverse solicitation after the end of the UK transition period, and the ESMA guidelines on reverse solicitation under the Markets in Crypto-Assets Regulation (MiCA). That is guidance by analogy from securities law into banking law, and it will be tested. The EBA has also said clarification of how Article 21c interacts with the UCITS Directive and the Alternative Investment Fund Managers Directive “could be beneficial to authorities and market participants”.

The third is supervisory appetite for subsidiarisation. Article 48i lets a competent authority require a branch to convert into an authorised credit institution where the group’s aggregate EU branch assets reach €40 billion, where a single branch books more than €10 billion, or where the branch meets systemic-importance indicators. That is a discretionary power over some of the largest US, UK, Japanese and Swiss banking groups in the Union, and no competent authority has yet said how it will exercise it. The EBA consultation that closed on February 3, 2026 drew a single confidential response — a reasonable proxy for how far the industry still is from treating January 2027 as a live date.

FAQ

Does CRD VI abolish reverse solicitation?

No. Article 21c(2)(a) preserves it: a third-country undertaking may provide core banking services where an EU client or counterparty approaches it at that client’s own exclusive initiative. What ends is the patchwork of national exemptions that let non-EU banks serve EU clients without any local presence. From January 11, 2027 reverse solicitation is the only general cross-border route left, and it is drafted so that any marketing, intermediation or cross-selling defeats it. It works for a genuinely unsolicited transaction; it does not support a sales strategy.

Which activities count as core banking services?

Points 1, 2 and 6 of Annex I to the CRD: taking deposits or other repayable funds, lending, and guarantees and commitments. Lending includes consumer credit, credit agreements relating to immovable property, factoring, financing of commercial transactions and forfaiting. Investment services under Section A of Annex I to MiFID II and their ancillary services are expressly carved out. Cash held as unconditionally repayable client balances can amount to deposit-taking even where nothing is marketed as a deposit.

Are non-bank lenders in scope?

For lending, generally not. Article 47(1) catches lending and guarantees only where the third-country head undertaking would qualify as a credit institution — or as an investment firm above the €30 billion threshold that must be re-authorised as one — if established in the Union. Insurance undertakings, commodity dealers and collective investment undertakings are excluded, so credit funds fall outside the branch requirement for lending. Deposit-taking is different: it catches any third-country undertaking.

What happens to existing loans and facilities?

Contracts entered into before July 11, 2026 are grandfathered and may continue to be performed without a branch. The exposure is lifecycle events: amendments and restatements, accordion increases, new borrowers acceding, extensions and refinancings all raise the question of whether the protected contract still exists. Where grandfathering is lost, the firm needs another exemption — usually reverse solicitation — or an authorised branch.

How long does branch authorisation take?

Under EBA/GL/2026/08, competent authorities should finalise the assessment within six months of the start of the assessment period, or in any case within 12 months of receiving the application, and the assessment period only starts once the file is complete. The application must include a business plan, capital endowment evidence, liquidity and governance arrangements, booking arrangements, reporting capability and a statement of non-opposition from the home supervisor.

Does an authorised branch get an EU passport?

No. Authorisation is territorial: the branch may provide core banking services only in the member state that authorised it. The two exceptions are intragroup funding transactions with other third-country branches of the same head undertaking, and transactions arising from reverse solicitation. Breaching the territorial scope is itself a ground for the competent authority to trigger the subsidiarisation procedure under Article 48i. Groups wanting pan-EU reach need multiple branches or an authorised EU subsidiary.

For related coverage of how supervisory perimeters are being redrawn across jurisdictions, see our analysis of the SEC-CFTC memorandum of understanding on dual registrants and of the FCA’s decision to drop FX derivatives from UK transaction reporting by 2028.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.