A Cyprus Investment Firm authorised by the Cyprus Securities and Exchange Commission can provide its services in any other member state of the European Economic Area without applying for a new authorisation. The mechanism is the EU passport. Two routes are available: a services passport, where the firm provides services across the border without establishing in the host country; and a branch or tied-agent passport, where the firm sets up a physical or contractual presence in the host country. This article walks the practical mechanics of both, with particular attention to the steps that catch firms by surprise, the matters the host regulator retains, and the parts of the answer that the passport does not actually deliver.
The two passports
The regime is set by Directive 2014/65/EU on markets in financial instruments (MiFID II), transposed in Cyprus by the Investment Services and Activities and Regulated Markets Law of 2017 (Law 87(I)/2017). The passport architecture sits in two adjacent articles of the Directive.
The services passport, formally the freedom to provide services, allows the firm to provide investment services, activities and ancillary services into another member state without establishing a branch and without using a tied agent established in that member state. The host country has no presence of the firm to supervise on the ground; conduct-of-business supervision in respect of the cross-border services stays with the Cyprus Securities and Exchange Commission, subject to the matters the host country reserves to itself.
The branch or tied-agent passport, formally the freedom of establishment, allows the firm to establish a branch in the host country, or to appoint a tied agent established in the host country. A tied agent established outside Cyprus is treated as if the firm had established a branch in that country, and the same supervisory framework applies.
The choice between the two routes is a question of footprint and supervisory exposure. The services passport is lighter to set up and continues to be supervised primarily from Cyprus. The branch or tied-agent passport carries a heavier operational footprint and brings the host regulator into the day-to-day supervisory perimeter of the cross-border activity.
The notification process, outbound from Cyprus
For the services passport, the Cyprus Investment Firm submits CySEC Form 87-00-04 to the Cyprus Securities and Exchange Commission. The form contains a programme of operations, the services and activities the firm intends to perform in the host country, the financial instruments concerned, the client categories the firm will serve, and whether the firm intends to use tied agents established in Cyprus to support the activity. The Cyprus Securities and Exchange Commission has one month from receipt of a complete file to transmit the notification to the host competent authority. The firm may begin cross-border activity from the moment of transmission. Any change to the particulars previously notified must be communicated at least one month before the change takes effect.
One practical point catches firms by surprise. A separate Form 87-00-04 is required for each host country. A Cyprus Investment Firm passporting into Greece and Italy submits two notifications, one for each country, not a single consolidated form covering both. The same logic applies to the branch and tied-agent passports: one notification per host country, even where the underlying scope of activity is identical.
A further practical point applies where the firm intends to offer packaged retail and insurance-based investment products (PRIIPs) to retail clients in the host country. The Cyprus Securities and Exchange Commission requires prior written confirmation from the firm that the Key Information Documents for those products will be translated into the official language of the host country before any service is provided. Without that confirmation, the application does not proceed. The translation obligation is a host-country investor-protection point that the home regulator is required to verify at the front end rather than after the passport is in place.
For the branch passport, the firm submits CySEC Form 87-00-06 with a fuller programme of operations: the organisational structure of the branch, the names and roles of those responsible for managing the branch, the tied agents the branch intends to use, and the address from which documents and information may be obtained. The Cyprus Securities and Exchange Commission has three months to transmit the notification to the host competent authority, together with particulars of the Investor Compensation Fund of which the firm is a member. The branch may then commence business on the earlier of receipt of communication from the host competent authority or the expiry of two months from the date of transmission. The Cyprus Securities and Exchange Commission may refuse to transmit where it has reason to doubt the adequacy of the firm's administrative structure or financial situation; refusal must be reasoned and is open to judicial review.
The tied-agent passport, for a tied agent established in the host country, is initiated by CySEC Form 87-00-07. The procedure tracks the branch passport because the tied agent is treated as if it were a branch. Termination or cessation of any of the passports is notified via CySEC Form 87-00-08.
In end-to-end terms, the services passport runs around one month from clean submission to commencement of activity. The branch and tied-agent passports run three to five months. The passport cannot exceed the scope of the home authorisation. Any new investment service, new financial instrument or new client category to be offered in the host country must first be reflected in an extension of the Cyprus authorisation. The capital requirements of a Cyprus Investment Firm and the Cyprus Securities and Exchange Commission licensing process are addressed in their own pieces in this section.
The extension itself, however, is the starting point of the cross-border process and not the end of it. A common mistake firms make at this stage is to receive the Cyprus Securities and Exchange Commission's approval of the extension, file it on the corporate record, and assume the new scope is now usable in each of the host countries where the firm already operates. It is not. Once the Cyprus Securities and Exchange Commission has approved the extension, the firm has to re-file the passport notification for each host country in which it wants to offer the new scope, on a fresh Form 87-00-04 for the services passport or a fresh Form 87-00-06 for the branch passport, covering the extended scope. Until the host country has received that notification, the firm holds the extended local authorisation but does not have the right to use it in the host country. The Cyprus approval is the licence to do the activity from Cyprus; without re-passporting it country by country, the licence does not travel.
What the passport does not deliver
The passport is a procedural mechanism, not a substantive grant of cross-border equivalence. Several matters remain with the host country, or fall outside the passport regime altogether.
On paper, the host competent authority is responsible under MiFID II for ensuring the branch's compliance with the harmonised conduct-of-business obligations. In practice, the host regulator's direct supervisory activity on a Cyprus Investment Firm's branch is far narrower than the legal text suggests. The branch's day-to-day supervision continues to be exercised, in operational terms, by the Cyprus Securities and Exchange Commission as home authority. The home authority holds the firm's authorisation, the firm's prudential file, and the operational relationship through which the firm reports and responds. Where the host regulator's direct supervisory activity does show up at the branch, it is concentrated on anti-money-laundering compliance rather than on the wider conduct-of-business obligations the framework allocates to it on paper.
The anti-money-laundering side of host supervision is not theoretical. An unannounced visit from the host country's regulator to inspect the branch's anti-money-laundering practices, the client files, and the onboarding documentation is a real possibility. Citius Trust has acted for a Cyprus Investment Firm whose branch in another Member State received exactly that visit: the host regulator arrived, asked to review the branch's anti-money-laundering procedures and a sample of client files, and conducted the inspection on the day. The visit was not a sign that anything had gone wrong; it was the host regulator exercising the supervisory remit that the framework genuinely gives it, which is over the anti-money-laundering side rather than over conduct of business in the broader sense.
The host country can take precautionary measures where it considers a Cyprus Investment Firm is acting in a manner clearly prejudicial to host-country investors or to the orderly functioning of the markets. The procedure runs through the home regulator first; where the home regulator's response is inadequate, the host authority can take measures, including the possibility of preventing further transactions in its territory, after informing the Cyprus Securities and Exchange Commission. The European Commission and the European Securities and Markets Authority must be informed. The power is largely a backstop; firms rarely encounter it in practice.
The host country also retains product-intervention powers under MiFIR. It can prohibit or restrict the marketing, distribution or sale of specific financial instruments, or types of financial activity, where a significant investor-protection concern or a threat to the orderly functioning of markets is identified, where the measure is proportionate, and where notice is given to other competent authorities and to the European Securities and Markets Authority at least one month before the measure takes effect.
Reverse solicitation, on the European Securities and Markets Authority's published reading, is confined to a narrow class of cases of genuine client initiative. Any solicitation, promotion or advertising in the Union defeats the exclusive-initiative requirement, regardless of contractual disclaimers. The principle is not a substitute for the passport for ongoing business.
Investor compensation continues to be governed by the home Member State scheme: for a Cyprus Investment Firm, the Investor Compensation Fund administered by the Cyprus Securities and Exchange Commission.
The passport does not address tax. Cross-border activity in another Member State may give rise to permanent-establishment exposure, value added tax considerations, and withholding-tax questions, all of which sit alongside the regulatory passport and must be analysed separately.
Tied agents, branch managers, and the fit-and-proper interview
Tied agents are a defined category under MiFID II. A tied agent acts under the full and unconditional responsibility of a single investment firm, on whose behalf it promotes services to clients, receives and transmits orders, places financial instruments, or provides advice. The appointing firm remains fully responsible for the tied agent's acts and omissions. Where the tied agent is established in a Member State outside Cyprus, it is treated as if the firm had established a branch in that country, and the branch passport's framework applies.
One operational point that the form-and-procedure description does not capture is the role of the proposed manager. For a branch passport, the branch manager must pass a fit-and-proper assessment by the Cyprus Securities and Exchange Commission. For a tied-agent passport, the same applies to the tied agent's manager. The assessment usually includes an interview with Cyprus Securities and Exchange Commission officers. The interview is not a formality; the Commission has refused to transmit notifications where the proposed manager has not satisfied the test, and the fit-and-proper assessment is frequently the gating step that determines whether the file moves on the statutory timeline or sits.
Passporting beyond the EEA
The MiFID II passport operates within the European Economic Area only. A Cyprus Investment Firm intending to offer services in a country outside the European Economic Area cannot rely on it. The Cyprus Securities and Exchange Commission has nonetheless developed a separate procedure for outbound activity to third countries, and that procedure has become one of the most challenging parts of cross-border work for many firms.
The pre-2022 position was workable. The firm submitted a legal opinion from a lawyer admitted in the third country confirming that the activity the firm proposed to undertake there did not require local authorisation and was not otherwise unlawful. The opinion was provided by the firm to the Cyprus Securities and Exchange Commission as part of the third-country notification file. The legal opinion path closed in November 2022 with CySEC Circular C534. The Cyprus Securities and Exchange Commission now requires the confirmation to come directly from the supervisory authority in the third country. The firm has to contact the third-country regulator, explain the activity it proposes to undertake, and obtain a written response from that authority confirming that the activity does not require local authorisation and is permitted. The firm then submits that response to the Cyprus Securities and Exchange Commission.
Practically, this is a substantial step. Many third-country regulators are not set up to receive requests of this kind, do not have a published procedure for responding to them, and either do not respond at all or respond on timelines measured in months. The Cyprus Securities and Exchange Commission's own transmission window does not start running until the host-regulator confirmation is on the file. For a Cyprus Investment Firm planning to serve clients in non-EEA jurisdictions, the third-country procedure now sits on the critical path of the project, and the timeline is determined by the responsiveness of the third-country authority rather than by the Cyprus side.
The cross-border reporting that follows
Annual cross-border reporting was introduced by the European Securities and Markets Authority following its March 2022 peer review of cross-border supervision and the Article 16 recommendations it issued to the Cyprus Securities and Exchange Commission. The Cyprus Securities and Exchange Commission implemented the reporting through the Cross-Border Activity Reporting Template for Cyprus Investment Firms, known as the CBRT-CIF. The reporting started in 2025 for the 2024 reference year, so the regime is still relatively new. CySEC Circular C694 of March 2025 set the operative framework, and two follow-up circulars, C754 and C757 of February 2026, requested additional data points for the same exercise.
The reporting obligation applies to Cyprus Investment Firms with more than fifty active retail clients in at least one Member State during the relevant year. The reporting threshold is therefore higher than most firms expect; the firm with handfuls of retail clients in any one country falls outside it, while the firm with material retail activity in even one host country falls in.
What the survey asks is more informative than the framework it sits inside. The reporting captures, by reportable country, the number of active retail clients during the year; the financial instruments and services provided to clients in that country; the use of tied agents, branches or other distribution channels in that country; and the number of complaints received from clients in that country, broken down by product category. The complaints-by-product-category-per-country slice is the data point that has caught most firms by surprise. It requires the firm's complaints log to be tagged by both client country and product category from the start of the reporting year. A complaints log that has not been built to do that cannot produce the report at year-end without a substantial reconstruction exercise.
For firms passporting into multiple host countries, the reporting overhead grows with the number of countries. The data points themselves are not difficult once the firm's systems collect them at the right level of granularity. The challenge is preparing those systems before the activity begins, rather than after.
The passport is, at its core, a procedural mechanism. A Cyprus Investment Firm can provide services across the European Economic Area to the extent of its Cyprus authorisation, either by serving clients in the host country from Cyprus or by establishing a branch or tied agent there. The statutory windows are short on paper; the practical timelines are longer, driven by the completeness of the notification file, the responsiveness of the host regulator, and the fit-and-proper assessment of the branch or tied-agent manager. Where the firm wants to serve clients outside the European Economic Area, the passport does not apply at all, and the third-country procedure rewards being started early.