ESMA Review on the Supervision of Cross-Border Investment Services in the EU

Implications for Firms in Germany

Management Summary

ESMA’s recent follow-up report to the Peer Review on the supervision of cross-border activities of investment firms assesses how national competent authorities oversee firms providing investment services to clients in other EU/EEA Member States under the passporting regime. It signals increased supervisory scrutiny of cross-border investment services. The growth of EU passporting has expanded market access for firms, but it has also exposed a supervisory gap: home authorities remain primarily responsible for conduct supervision, while investor harm often arises in host Member States. Germany is particularly affected, both as a major home jurisdiction for firms providing services abroad and as a key recipient market.

BaFin’s supervision of cross-border activities is likely to become more intensive, data-driven and intrusive. Firms should expect stricter scrutiny of authorisations and passport notifications, closer monitoring of actual cross-border activity, and greater attention to complaints, client classification, high-risk products and governance arrangements. Elevated complaint volumes, rapid growth or inconsistencies between reported and actual business may trigger supervisory enquiries, own-initiative examinations or enforcement action.

Firms should therefore review their cross-border operating model now. This includes mapping where services are provided, to which client categories, through which channels and under which permissions; reconciling this with regulatory notifications and reporting; strengthening complaint-handling and governance; and ensuring that cross-border risks are properly embedded in compliance and risk management. Cross-border business should no longer be treated as a purely formal passporting matter, but as an area requiring active senior management oversight and robust documentation.

Supervisory gap within the EU passporting regime

The EU market for investment services is gradually becoming more integrated. According to ESMA's 2024 report on cross-border investment services in the EU, the cross-border market comprises 370 firms across 30 EU/EEA Member States serving around 10.5 million retail clients in other Member States – an increase of over 30% in the number of retail clients compared with the equivalent 2023 figures. Germany sits at the centre of the cross-border retail market from both directions: its firms are among the largest exporters of investment services, while German residents are simultaneously the largest group of recipients. Germany is the third-largest home jurisdiction, hosting 47 of the 370 firms (13%), and German-based firms served around 2 million retail clients in other Member States in 2024 — up sharply from about 1 million a year earlier.

This growing integration, however, brings investor-protection challenges. ESMA recorded over 10,000 complaints from cross-border retail clients in 2024. These were dominated by operational and service-related issues — chiefly general administration and customer service, followed by “other” matters (including emerging topics such as greenwashing and copy trading), IT problems and difficulties withdrawing funds. Germany-based firms received the largest share, accounting for 45% of the EU/EEA total (4,936 complaints), up from 35% in 2023, with around 42% of these relating to general administrative and customer-service issues.

One explanation lies in a structural supervisory gap rooted in the EU passporting regime on which cross-border services are based. Upon notification to the relevant NCA, a credit institution or investment firm authorised in one Member State may provide investment services throughout the EU/EEA without separate authorisation elsewhere. Host Member States must allow it to provide, within their territory, the services covered by its authorisation, and may not impose additional requirements; supervisory responsibility rests with the National Competent Authority (NCA) of the Member State in which the firm is established.

This allocation creates a structural gap. Because MiFID II's investor-protection rules are enforced primarily by the home NCA, that authority may have limited incentive or capacity to police how a firm treats clients located abroad, as the potential harm does not materialise on its own territory. The host NCA, by contrast, observes detriment to its citizens but has limited legal power to intervene, since the firm is licensed and supervised elsewhere. Several EU jurisdictions have consequently experienced cases in which investment services were provided under the freedom to provide services (FPS) to the prejudice of retail investors in the host state, frequently in connection with high-risk products such as contracts for difference (CFDs). Divergent supervisory intensity across home NCAs has therefore translated directly into uneven enforcement of the same investor-protection rules.

ESMA’s review of the supervision of cross-border investment services

Against this backdrop, ESMA has stepped up its monitoring of cross-border investment services to retail clients in the EU. In a recent peer review it focuses on the six home NCAs with the most significant outbound activity — including Germany, the Netherlands and Luxembourg — and examining authorisations; ongoing supervision, cooperation among authorities as well as enforcement and sanctioning. Its findings across these four areas can be summarised as follows:

• Authorisations. Most authorities apply granular scrutiny of cross-border plans at the licensing stage, covering governance, internal controls, language capabilities and host-country compliance. Where an authority relies on expert judgement rather than pre-set criteria, ESMA calls for objective criteria and common staff guidance to ensure consistent outcomes.
• Ongoing supervision. Most authorities collect and use data on firms' actual cross-border activity within risk-based models and include cross-border firms and a representative sample of their clients in inspections. However, some authorities lack a sufficiently systematic approach, and in the largest outbound markets supervisory activity appears contained relative to the volume of business and the number of complaints — prompting ESMA to call for more intrusive, own-initiative supervision.
• Cooperation among authorities. Cooperation between NCAs is generally effective. Where timeliness was a concern, the authority in question introduced tracking and monitoring of request-handling times to ensure requests are addressed promptly.
• Enforcement and sanctioning. Authorities make use of strong measures in places, including licence revocations and sizeable fines. In the largest markets, however, ESMA finds the number of measures contained relative to the volume of activity and complaints, and calls for enforcement to be commensurate with risk, particularly against repeat infringers.

The report follows up on an initial 2021 peer review that had identified various shortcomings in the supervision of cross-border services and issued recommendations to close the gaps. Overall, ESMA finds that NCAs have made significant progress in gathering and using cross-border data and embedding it in their risk-based supervision. A residual, concentration-driven risk nonetheless remains, warranting continued vigilance in the jurisdictions with the most significant outbound activity.

In Germany, BaFin has strengthened its oversight of cross-border activities by introducing a detailed review scheme for authorisations, conducting ongoing risk-based supervision using ESMA data, and establishing a dedicated cross-border team. It carries out investigations, including external audits and follow-ups with major firms, and has taken enforcement actions such as license revocations and significant fines. ESMA recommends that BaFin intensify intrusive supervision beyond annual or special audits by conducting own-initiative examinations of firms with the largest activity or complaint volumes. It also urges BaFin to ensure its enforcement actions are proportionate to the volume and risks of its outbound cross-border activities, stressing the need for continued close monitoring and robust supervisory and enforcement efforts.

Implications for credit institutions and investment firms in Germany

ESMA's efforts to enforce EU investor-protection rules on a cross-border basis, and BaFin's increasing attention to them, have significant implications for credit institutions and investment firms in Germany offering cross-border services in the EU. Specifically, the relevant firms should expect the following supervisory measures:

• Stricter authorisation gatekeeping in Germany – applicants must complete BaFin's cross-border review scheme, detailing services, target jurisdictions, customer profiles, profit drivers, growth plans and how cross-border risks are embedded in compliance and risk management; investment firms providing cross-border services must appoint at least two managing directors.
• Data-driven, risk-scored supervision – BaFin scores firms using ESMA data and cross-checks MiFIR transaction reporting; firms scoring 10 or more, and those with the largest activity or complaint volumes, should expect closer and potentially own-initiative scrutiny, so consistency between declared and actual cross-border activity is important.
• Prospect of intensified supervision – BaFin has revoked licenses and imposed sizeable fines, and ESMA's recommendation points towards more, not fewer, intrusive measures over time. Firms should anticipate increasing supervisory engagement, own-initiative examinations and information requests going forward.

The supervisory measures examined in the peer review focus on cross-border services provided to retail clients. Firms whose cross-border clients are exclusively professional clients, or eligible counterparties may expect comparatively less supervisory attention in this specific context. Firms should nonetheless consider hybrid situations. Ultra-high-net-worth clients, for example, are frequently (re)classified as professional clients on request or serviced through investment vehicles that sit outside the retail dataset, so the effects of the tightening supervisory framework on them are more indirect. This makes the accuracy and documentation of client categorisation a key point of attention, since a misclassification can bring an activity back within the scope of enhanced retail-focused scrutiny. For genuinely cross-border wealth-management relationships, the locally supervised branch route may also offer greater legal certainty than remote provision under the freedom to provide services, albeit at the cost of accepting host-state conduct supervision.

ESMA's efforts to streamline the supervision of cross-border services should also be of particular note to third-country firms. In the aftermath of Brexit, many firms relocated operations from the UK to EU Member States to preserve their access to the EU market. While they were initially reluctant to build up local substance in those Member States, they have since come under growing regulatory and supervisory pressure — for example, through the ECB's Desk Mapping Review and, more recently, CRD VI, which restricts the provision of cross-border banking services from third countries. As a result, many third-country firms are now reconsidering their legal-entity setup in the EU.

Next steps for Third-Country-Firms

Against this backdrop, these firms should anticipate an increasingly consistent and rigorous supervision of EU investor-protection rules. As home NCAs enhance their oversight of cross-border activities — collecting more granular data, embedding cross-border risks into their risk-based models and making greater use of intrusive tools — the level of scrutiny applied to services provided into other Member States is set to rise. This is reinforced by ESMA's own convergence initiatives, including cross-authority information-sharing systems, which make a firm's cross-border footprint more transparent to supervisors across the EU. Third-country firms should therefore consider potential supervisory enquiries about their cross-border activities within the EU. In practice, this means being able to demonstrate, on request, where and to whom services are provided, how cross-border risks are identified and managed within their compliance and control functions, and that their actual activity is consistent with the scope of their authorization and passport notifications. Ensuring that client classifications, complaint-handling arrangements and internal documentation are robust and readily available will be key to meeting these expectations and avoiding the elevated scrutiny that inconsistencies increasingly attract. The scope for regulatory arbitrage — establishing EU headquarters in a Member State with relatively light-touch supervision — is likely to narrow in the future. This trend may be reinforced at the structural level: the European Commission has proposed expanding ESMA's powers, potentially shifting certain supervisory competences from the national to the EU level. Should this materialize, differences in supervisory intensity between Member States would diminish further, making the choice of home jurisdiction a progressively less effective means of reducing regulatory exposure.

If you have questions about the report or the challenges ahead for investment firms, or would like to share your perspective, please contact us. We would be pleased to support you.