EU passporting from a Cyprus Investment Firm,
the statutory framework.

This article addresses the European Union passport of a Cyprus Investment Firm authorised under the Investment Services and Activities and Regulated Markets Law of 2017 (Law 87(I)/2017), transposing Directive 2014/65/EU on markets in financial instruments. Two passport types are available: the freedom to provide services under Article 34, and the right of establishment by branch or by tied agent under Article 35. The home competent authority is the Cyprus Securities and Exchange Commission; the host is the competent authority of the Member State into which the firm passports. The article sets out both passport types, the notification process, the allocation of supervision, the matters the passport does not deliver, and the adjacent regimes for crypto-asset services, alternative investment funds and undertakings for collective investment in transferable securities.

The legal architecture

The Cyprus Investment Firm regime is established by Law 87(I)/2017, which transposes Directive 2014/65/EU (MiFID II). It is read together with Regulation (EU) No 600/2014 (MiFIR), Commission Delegated Regulation (EU) 2017/1018 on the content of passport notifications, and Commission Implementing Regulation (EU) 2017/2382 on the forms and procedures for those notifications. Prudential requirements for Cyprus Investment Firms are set by Regulation (EU) 2019/2033 (the Investment Firms Regulation) and Directive (EU) 2019/2034 (the Investment Firms Directive). Coordination, peer review and supervisory convergence among national competent authorities are the responsibility of the European Securities and Markets Authority under Regulation (EU) No 1095/2010.

The passport architecture in Articles 34, 35 and 36 of MiFID II was not altered by the MiFIR review enacted in Regulation (EU) 2024/791 and Directive (EU) 2024/790, both of which entered into force on 28 March 2024 with phased application thereafter. The revised technical standards for passporting notifications proposed by the European Securities and Markets Authority in Final Report ESMA35-36-2848 of 11 July 2023 had not been adopted by the European Commission at the date of writing. The 2017 Delegated and Implementing Regulations therefore remain in force.

The two passports

The first passport, under Article 34 MiFID II, is the freedom to provide investment services and activities, together with ancillary services, into another Member State without establishing a branch and without using a tied agent established in that Member State. Conduct of business in respect of those services remains with the home competent authority, subject to the matters the host Member State reserves to itself under Article 35(8) for branch activity and Article 86 for precautionary measures.

The second passport, under Article 35 MiFID II, is the right of establishment. The firm may establish a branch in another Member State, or appoint a tied agent within the meaning of Article 4(1)(29) MiFID II established in another Member State. A tied agent established outside the home Member State is, by virtue of Article 29(2), assimilated to a branch and brought within the same supervisory framework. The host competent authority assumes responsibility under Article 35(8) for compliance, by the branch, with the conduct-of-business obligations in Articles 24, 25, 27 and 28 MiFID II and Articles 14 to 26 MiFIR, together with measures adopted by the host Member State under Article 24(12) of the Directive.

The choice between the two passports is a question of footprint and supervisory exposure. The services passport carries a lighter operational footprint and home conduct of business. The branch or tied-agent passport carries a heavier operational footprint and host conduct of business at the branch level. The choice depends on facts the law does not anticipate.

The notification process, outbound from Cyprus

For the services passport, the Cyprus Investment Firm submits Cyprus Securities and Exchange Commission Form 87-00-04 with the information specified by Article 34(2) MiFID II and Commission Delegated Regulation (EU) 2017/1018: a programme of operations, the investment services and activities and ancillary services to be performed, the financial instruments concerned, the client categories, and the intended use of tied agents established in the home Member State. The Cyprus Securities and Exchange Commission has one month from receipt of complete information to transmit the notification to the competent authority of the host Member State (Article 34(3) MiFID II). The firm may commence cross-border activity from the moment of transmission. A change to any particular previously notified must be communicated at least one month before the change is implemented (Article 34(4) MiFID II).

For the branch passport, the firm submits Cyprus Securities and Exchange Commission Form 87-00-06 with the information specified by Article 35(2) MiFID II and the Commission Delegated Regulation: the host Member State; a programme of operations describing the services and activities to be performed; the organisational structure of the branch; the names of those responsible for the management of the branch; the tied agents the branch intends to use; and the address from which documents may be obtained. The Cyprus Securities and Exchange Commission has three months to transmit the information to the host competent authority (Article 35(3) MiFID II), together with particulars of the accredited Investor Compensation Fund of which the firm is a member. The branch may commence business on the earlier of receipt of communication from the host competent authority or the expiry of two months from the date of transmission (Article 35(6) MiFID II). The Cyprus Securities and Exchange Commission may, under Article 35(3) MiFID II, refuse to transmit where it has reason to doubt the adequacy of the firm's administrative structure or financial situation; refusal must be reasoned and is open to judicial review.

The tied-agent passport, for a tied agent established outside the home Member State, is initiated by Cyprus Securities and Exchange Commission Form 87-00-07. The procedure tracks the branch passport because of the Article 29(2) assimilation rule. Termination or cessation of any of the passports is notified via Cyprus Securities and Exchange Commission Form 87-00-08.

A practical end-to-end timeline of approximately one month for the services passport, and approximately three to five months for the branch or tied-agent passport, is consistent with the statutory windows when the notification file is complete at first submission. The passport cannot exceed the scope of the home authorisation: any new investment service, new financial instrument or new client category to be offered in the host Member State must first be reflected in an extension of the Cyprus authorisation. The capital requirements of a Cyprus Investment Firm and the Cyprus Securities and Exchange Commission licensing process are addressed elsewhere in this section.

What the passport does not deliver

The passport is a procedural mechanism, not a complete grant of cross-border equivalence. Several matters remain with the host Member State or fall outside the passport regime altogether.

Conduct of business at the branch level (the obligations under Articles 24, 25, 27 and 28 of MiFID II and Articles 14 to 26 of MiFIR, together with any additional information requirements adopted by the host Member State under Article 24(12)) is the responsibility of the host competent authority (Article 35(8) MiFID II). Branch supervision in this respect is not displaced by the home authorisation.

Precautionary measures by the host Member State are available under Article 86 MiFID II. Where the host competent authority has clear and demonstrable grounds for believing that a Cyprus Investment Firm acting within its territory under the freedom to provide services infringes obligations adopted pursuant to the Directive, or that a branch infringes obligations not conferred on the host authority by the Directive, the matter is first referred to the home competent authority. Where the home authority's response is inadequate, or the firm persists in conduct clearly prejudicial to the interests of host Member State investors or to the orderly functioning of markets, the host competent authority shall take all appropriate measures, including the possibility of preventing further transactions, after informing the home authority. The European Commission and the European Securities and Markets Authority must be informed without undue delay.

Product intervention by the host Member State under Article 42 MiFIR is available where a significant investor-protection concern or a threat to the orderly functioning of markets is identified, the measure is proportionate, and notification is given to all other competent authorities and to the European Securities and Markets Authority at least one month before the measure is intended to take effect. In exceptional cases of urgency, the action may be on a provisional basis with no less than twenty-four hours' prior written notice and may not exceed three months.

Reverse solicitation, on the European Securities and Markets Authority's published reading in Public Statement ESMA35-43-2509, is confined to cases of genuine and exclusive client initiative. Any solicitation, promotion or advertising in the Union defeats the exclusive-initiative requirement, irrespective of contractual disclaimers. The Authority's Guidelines on Reverse Solicitation under Regulation (EU) 2023/1114 (MiCA) of 26 February 2025 apply the same approach in the crypto-asset context. Reverse solicitation is not a substitute for the passport for ongoing business.

Investor compensation continues to be governed by the scheme of the home Member State. For a Cyprus Investment Firm, that is the Investor Compensation Fund administered by the Cyprus Securities and Exchange Commission under directives issued under Law 87(I)/2017, in line with Directive 97/9/EC. Anti-money-laundering supervision of a branch in another Member State is, under Article 48 of Directive (EU) 2015/849, a host Member State competence.

The passport does not address tax. Cross-border activity in another Member State may give rise to permanent-establishment exposure, value added tax issues, and withholding-tax considerations independent of the regulatory passport, and these must be analysed separately. Cyprus-side tax positioning for an investment firm capitalised through new equity is addressed elsewhere in this section.

Tied agents and the assimilation rule

A tied agent within the meaning of Article 4(1)(29) MiFID II is a person who, under the full and unconditional responsibility of only one investment firm on whose behalf it acts, promotes investment or ancillary services to clients, receives and transmits orders, places financial instruments, or provides advice in respect of those instruments or services. Article 29 imposes registration and conduct obligations on tied agents and confirms that the appointing investment firm remains fully and unconditionally responsible for the agent's acts or omissions. Where a tied agent is established in a Member State outside the home Member State of the appointing firm, Article 29(2) assimilates the tied agent to a branch: the same notification procedure under Article 35, the same supervisory framework, and the same allocation of host conduct of business under Article 35(8) apply. The European Securities and Markets Authority's Supervisory Briefing on tied agents (ESMA35-43-2900 of 2 February 2022) sets out supervisory expectations for the appointing firm and the home and host competent authorities.

Adjacent EU regimes, MiCA, AIFMD and UCITS

A Cyprus Investment Firm that wishes to provide crypto-asset services within the meaning of Regulation (EU) 2023/1114 on Markets in Crypto-Assets has, under Article 60 of that Regulation, a simplified notification regime where the crypto-asset services are equivalent to investment services for which the firm is already authorised. The notification is filed with the Cyprus Securities and Exchange Commission at least forty working days before first provision. Article 60 maps placing of crypto-assets to underwriting or placing of financial instruments on a firm-commitment basis; reception and transmission of orders for crypto-assets to the equivalent service for financial instruments; advice on crypto-assets to investment advice; and portfolio management of crypto-assets to portfolio management. A firm notifying under Article 60 is exempt from the application of a defined list of MiCA articles addressing authorisation and operational requirements that would otherwise apply to a stand-alone crypto-asset service provider. Cross-border provision of crypto-asset services within the European Economic Area thereafter is governed by Article 65 MiCA, which contemplates a ten-working-day notification window from the home to the host competent authority.

The Markets in Crypto-Assets Regulation became fully applicable on 30 December 2024. The Cyprus transitional period for previously-registered crypto-asset service providers closes on 1 July 2026, and the Cyprus Securities and Exchange Commission's deadline for full applications was 27 February 2026.

Two further passport regimes sit alongside MiFID II and are not within it. Directive 2011/61/EU on Alternative Investment Fund Managers provides a separate passport for alternative investment fund managers and the alternative investment funds they manage and market, under Articles 31, 32 and 33, transposed in Cyprus by the Alternative Investment Fund Managers Law 56(I)/2013. Directive 2009/65/EC on Undertakings for Collective Investment in Transferable Securities provides a separate passport for management companies and funds, under Articles 16 to 21 and Article 93. Neither regime is a substitute for the MiFID II passport, and neither is overridden by it; a firm operating across the two regimes manages two passports.

Inbound to Cyprus, and third-country firms

Investment firms authorised in another European Economic Area Member State may passport into Cyprus by following the mirror-image procedure: the home competent authority of the firm transmits the notification to the Cyprus Securities and Exchange Commission, which acts as the host competent authority. The Cyprus Securities and Exchange Commission maintains a public register of inbound passporting firms and notifies the European Securities and Markets Authority of the firms authorised in Cyprus.

A firm established outside the European Economic Area is, for the purposes of MiFID II, a third-country firm. Two routes apply. For per-se professional clients and eligible counterparties in the Union, MiFIR Articles 46 and 47 contemplate registration with the European Securities and Markets Authority following a Commission equivalence decision. At the date of writing, the Commission has not adopted any equivalence decision under Article 47, and the registration regime under Article 46 is therefore not operationally available for any third country. For retail clients and elective professional clients in Cyprus, Article 39 MiFID II as transposed by Law 87(I)/2017 requires the establishment of a branch authorised by the Cyprus Securities and Exchange Commission, subject to the conditions in that Article including a cooperation arrangement between the home and host competent authorities and a tax-information-exchange standard. The United Kingdom, following its withdrawal from the European Union, is a third country for these purposes.

Ongoing reporting after the passport

Cross-border activity reporting is governed by the Cyprus Securities and Exchange Commission's instructions on form CBRT-CIF. Under Cyprus Securities and Exchange Commission Circular C694 of 27 March 2025, the reporting obligation applies to Cyprus Investment Firms with more than fifty active retail clients in at least one Member State during the relevant year. Two subsequent circulars, C754 and C757 of February 2026, requested additional cross-border data collection in coordination with the European Securities and Markets Authority. These data-collection exercises sit against the backdrop of the European Securities and Markets Authority's March 2022 peer review and the Article 16 recommendations issued to the Cyprus Securities and Exchange Commission on cross-border supervision. Separately, the obligations under Regulation (EU) 2022/2554 on Digital Operational Resilience (DORA) apply to a Cyprus Investment Firm from 17 January 2025 and impose, among other things, the maintenance of the Register of Information under Article 28(3); Cyprus Securities and Exchange Commission Circular C700 of 8 April 2025 sets out the national approach. The DORA obligations are independent of the passport but apply to a Cyprus Investment Firm operating cross-border. The composition of Cyprus business banking across local banks, neobanks and payment institutions is addressed separately.

Developments

The MiFIR review under Regulation (EU) 2024/791 and Directive (EU) 2024/790 entered into force on 28 March 2024. The passport architecture in Articles 34, 35 and 36 of MiFID II is not altered. Transparency, transaction reporting and certain third-country provisions are amended, with phased application; the date-of-application of any specific provision must be checked at the time of reliance.

The European Securities and Markets Authority's Final Report ESMA35-36-2848 of 11 July 2023 proposed revised regulatory and implementing technical standards for passporting under Article 34. The Commission had not adopted the revised standards at the date of writing, and the 2017 Delegated and Implementing Regulations therefore remain in force.

The European Union anti-money-laundering package adopted in 2024, comprising Regulation (EU) 2024/1624, Directive (EU) 2024/1640 and the AMLA Regulation (EU) 2024/1620, entered into force on 9 July 2024. The anti-money-laundering Regulation applies from 10 July 2027, and the transposition deadline for the sixth Anti-Money-Laundering Directive is the same date. In the interim, anti-money-laundering supervision of a branch in another Member State remains with the host Member State authority under Article 48 of Directive (EU) 2015/849. Directive (EU) 2024/927 (the AIFMD review) entered into force on 15 April 2024, with a transposition deadline of 16 April 2026; AIFMD II is not within the MiFID II passport but affects the wider passport ecosystem for firms operating across MiFID II and the alternative investment fund regime.

The passport is, at its core, a procedural mechanism. An investment firm authorised in one European Economic Area Member State may operate in any other Member State to the extent of its home-state authorisation, either without establishing a branch or through a branch or tied agent. The notification windows are statutory and definite. The supervisory split between home and host is established by Article 35(8) of MiFID II and Article 42 of MiFIR. Tax, anti-money-laundering supervision at branch level, host product intervention, host precautionary measures and the boundary on reverse solicitation sit alongside the passport and are not absorbed by it. The passport reflects the harmonisation that the Single Market has achieved in investment services. It does not displace what remains national.