Definition
The European passport lets an institution authorised in one EEA country (credit institution, payment institution, e-money institution, investment advisor, CASP, etc.) operate in the other 29 without a new authorisation.
Enshrined in PSD1/PSD2, MiCA, MiFID II and the sectoral directives, it is one of the pillars of European financial integration.
The two modes: FPS vs FoE
- FPS (freedom to provide services) — the institution operates from its home country toward customers in the target country, with no local presence. This is the case of Revolut, operating in France first from the UK and then from Lithuania.
- FoE (freedom of establishment) — the institution opens a branch or appoints an agent in the target country. More demanding, but it allows an operational presence.
The choice depends on the model: FPS for pure digital players, FoE when a physical presence is needed (branches, agents, local partnerships).
How it works in practice
The procedure is a declaration, not a new authorisation:
- The institution notifies its home authority (the ACPR in France).
- The latter forwards it to the host authority (BaFin, Banca d'Italia…) within 1 month.
- The host authority has 2 months to notify the local conditions (consumer protection, language of documentation).
- The institution can operate as soon as it meets these conditions.
No local authorisation, no additional capital, no duplicated governance — but the host authority retains supervisory power over certain aspects (consumer protection, local AML).
"Home-country control"
The principle is control by the home country: the authority that granted the authorisation remains the main prudential supervisor, even when the activity is mostly carried out abroad. This principle was criticised after several failures: Wirecard (DE, 2020), Cypriot/Maltese banks lax on AML, or N26 (a growth cap imposed by BaFin in 2021 for AML/CFT shortcomings). Hence the creation of the AMLA (Frankfurt, operational since July 2025, with direct supervision from 2028) to directly supervise the most exposed cross-border players.
What the passport does not waive
- Local AML/CFT: due diligence applies in every target country.
- Consumer protection: withdrawal rights, pre-contractual information, local complaints.
- Language: information in the local language in most countries.
- Local regulator: the duty to respond to the host NCA on local matters (mediation, fraud).
- Taxation: VAT and taxes remain territorial.
Eligible statuses
Credit institutions, payment institutions, e-money institutions (PSD2 + EMD2), management companies (UCITS, AIFMD), investment firms (MiFID II), investment advisors (under conditions), CASPs (since MiCA), insurers (Solvency II). By contrast, France's PSAN and the IOBSP, purely national statuses, are not passportable — a major reason for converting PSAN into CASP.
In the PSD2 ecosystem
The passport is what lets European fintechs scale without multiplying authorisations. It is what makes pan-European players possible: Revolut, N26, Wise, Klarna, Qonto, Bunq.
Concrete examples
- Revolut: historically from the UK, then from Lithuania (Revolut Bank UAB) after Brexit to keep the passport; authorised as a credit institution in Lithuania, as a bank in the UK, and in progress in France.
- N26: authorised as a credit institution in Germany, operates in 24 countries via the passport, with no branch.
- Wise: an e-money institution authorised in the UK and Belgium (post-Brexit), passporting throughout the EEA.
- Qonto: a payment institution authorised in France, passporting to Germany, Italy and Spain, under pure FPS.
- Klarna: a credit institution authorised in Sweden, passporting its BNPL throughout the EEA.
- Brexit: the loss of the passport (January 2021) forced Revolut, Wise and Monzo to duplicate their authorisations in an EEA State (Ireland, Lithuania, the Netherlands).
- Regulatory arbitrage: Lithuania, Malta and Cyprus attract through short timelines, at the risk of uneven supervision — a debated topic where the EBA pushes for more convergence.
- MiCA and CASP: the CASP passport triggered a rush for authorisations from 2024 (Binance, Coinbase, Kraken), making the purely French PSAN disappear in favour of a passportable authorisation.