MiFID II Triangular Passporting: ESMA’s July 2026 Supervisory Briefing

ByOfficer

On 7 July 2026 ESMA published a supervisory briefing on triangular passporting under MiFID II (reference ESMA35-243228190-8065), and the CSSF relayed it to Luxembourg professionals in a communique dated 17 July 2026. Triangular passporting is the arrangement where an authorised investment firm serves clients in one Member State through a branch or tied agent it has established in a different Member State. If that describes any part of your cross-border footprint, the briefing tells you who supervises it and what your passporting file must say.

The briefing records the common understanding ESMA and national competent authorities (NCAs) have reached on how MiFID II applies across three Member States, creating no new legal obligation and sitting outside any comply-or-explain mechanism. The message for reporting teams is blunt: the licence, the passport, and the supervision all follow the firm. This is a window to check your structure against ESMA’s expectations before a supervisor asks.

Related reading: our guide to the CSSF MiFID II and MiFIR FAQ.

How the triangular structure works

ESMA labels the three Member States A, B and C. Member State A is the home Member State where the firm is authorised. Member State B is the host where the firm has established a branch or tied agent under the freedom of establishment in Article 35 MiFID II. Member State C is a further host where that branch or tied agent then provides services on a cross-border basis under the freedom to provide services in Article 34 MiFID II.

The word triangular can mislead. This is an intra-EU arrangement across three Member States, so it sits apart from the third-country branch regime that captures firms headquartered outside the Union; if your structure routes services from outside the EU, our note on EBA third-country branch reporting is the better starting point. It also reaches credit institutions that provide investment services, not only standalone firms.

The licence, and the passport, stay with the firm

Deliver services into Member State C through a branch in Member State B, and the firm still holds the MiFID II licence and uses its own passporting rights. A branch has no separate legal personality, no separate licence, and so no passport of its own. A tied agent has separate legal personality but acts under the full and unconditional responsibility of the one firm it represents, so it too sits under that firm’s licence; Article 35(2) MiFID II assimilates a tied agent established outside the firm’s home Member State to a branch.

That shapes the tied agent contract. Because the reach into Member State C is created by the agent, ESMA expects the agreement to authorise cross-border activity on the firm’s behalf explicitly, and the firm to control the geographical scope of the agent’s work. ESMA also draws a limit: setting up a branch or tied agent in Member State B solely to passport onward could be considered out of line with Article 35, closer to forum shopping than genuine establishment.

Your passporting notifications carry the story

The reporting-desk artefact here is the passporting notification filed with the home NCA. A firm relying on triangular passporting is expected to state in it that a branch or tied agent in Member State B will serve Member State C, using the templates in the annexes to Commission Implementing Regulation (EU) 2017/2382. The Annex I template has no box marked triangular, so the cover letter ESMA describes is where I would flag that the Member State B branch or agent is the delivery channel into Member State C; the home NCA can also annotate the Annex II communication text.

The notification lists the authorised services intended for Member State C and stays current: any operational change triggers an update. ESMA lets the Article 35 establishment notification and the Article 34 services notification go in together, but service into Member State C may only start once the Article 35 time period has run. Firms are also expected to run and review an internal risk assessment of the model, covering investor protection, money laundering and terrorist financing, outsourcing and third-party risk, all of which widen across more than two jurisdictions. Firms building these files often check the CSSF MiFID II notification templates for the local submission mechanics.

Home NCA or host NCA: who actually supervises

This is the clarification most teams need in writing. The home NCA supervises the firm’s organisational requirements, including the branch or tied agent in Member State B. The host NCA in Member State B supervises the conduct-of-business requirements of that branch or tied agent for the services it provides in Member State B itself. For the services delivered cross-border into Member State C, both organisational and conduct-of-business supervision sit with the home NCA: a branch or tied agent holds no passporting rights, so the authority that granted the passport keeps the supervision that goes with it.

A common misreading is that the host NCA in Member State B, where the branch sits, picks up the Member State C services. It does not; that authority is not competent for services provided into another host Member State. ESMA is candid that this can be awkward: supervising the Member State C services may require the home NCA to inspect the branch or tied agent on the ground in Member State B, which needs cooperation from an authority that is not itself the competent supervisor. Article 79(1) MiFID II requires that cooperation, and Article 86 lets a host NCA take precautionary measures where investors or orderly markets in its territory are at risk and the home NCA’s measures fall short.

What clients in Member State C must be told

ESMA expects firms to tell clients in Member State C, clearly, that the service comes from the firm through a branch or tied agent established in Member State B. A second disclosure runs against what clients assume: the home Member State NCA, not the authority where the branch or agent physically sits, supervises the services provided to them. Any information given must be fair, clear and not misleading, and leaning on an existing branch or agent must not dilute investor rights or blur who stands behind the service.

Complaints, dispute resolution and compensation cover

Article 75(1) MiFID II requires Member States to ensure firms belong to at least one extra-judicial complaints mechanism. Where triangular passporting places a client in Member State C, ESMA expects the firm to inform that client, in clear and non-misleading terms, about access to complaints and redress and about the relevant investor compensation scheme. Cross-border investment disputes can go to alternative dispute resolution bodies affiliated with the EU Financial Dispute Resolution Network, FIN-NET, the route the briefing points to for Member State C clients.

The bar is low-friction. Clients in Member State C should be able to complain to the head office in Member State A or to the branch or tied agent in Member State B, in any language the firm uses in its marketing or contractual documents. Those complaints belong inside the complaints-handling procedure under Article 26 of the MiFID II Delegated Regulation: the firm records them and the measures taken to resolve them, and lets clients complain free of charge. The same follow-the-firm logic runs through MiFIR transaction reporting, where the duty tracks the authorised entity.

Frequently Asked Questions

Does the ESMA briefing create new obligations for firms?

No. It is a non-binding supervisory convergence tool, outside any comply-or-explain mechanism; the duties on notifications, client information and complaints already sit in MiFID II and its implementing measures.

Is triangular passporting the same as a third-country branch arrangement?

No. All three Member States are inside the Union. The third-country branch regime and its CRD6 authorisation requirements apply to firms headquartered outside the EU, under a separate supervisory logic.

Which authority supervises the services delivered into Member State C?

The home NCA, for both organisational and conduct-of-business requirements. The catch is reach: it may need to inspect the branch or tied agent in Member State B, which needs cooperation from that authority, though it is not competent for the Member State C services.

Do we have to file a fresh passporting notification?

You review and, where needed, update the existing ones, using the Regulation (EU) 2017/2382 templates with a cover letter on Annex I to state that a branch or tied agent in Member State B serves Member State C. Any operational change triggers an updated notification.

Where can a Member State C client complain, and in what language?

To the head office in Member State A or the branch or tied agent in Member State B, free of charge, in any language the firm uses in its marketing or contractual documents. The firm folds those complaints into its Article 26 record, and FIN-NET provides the cross-border ADR route.

Related Articles

Key Takeaways

  • The briefing (ESMA35-243228190-8065, 7 July 2026) is non-binding and creates no new legal obligation; it sets common supervisory expectations for triangular passporting under MiFID II.
  • Triangular passporting is intra-EU across three Member States, distinct from the third-country branch regime.
  • The firm holds the licence and the passport; a branch or tied agent in Member State B has no separate passporting rights, and the home NCA supervises the cross-border services into Member State C.
  • The notification should name the Member State B branch or tied agent serving Member State C, using the Regulation (EU) 2017/2382 templates plus an Annex I cover letter, updated on any operational change.
  • Establishing a branch or tied agent in Member State B solely to passport onward could be considered out of line with Article 35 MiFID II.
  • Member State C clients must be told the service comes through Member State B and that the home NCA supervises it; under Article 75(1) they get complaints and redress free of charge, in the firm’s language, via the Article 26 procedure and FIN-NET.

Sources and References

  • ESMA, Supervisory briefing on Triangular Passporting, ESMA35-243228190-8065, 7 July 2026: esma.europa.eu
  • CSSF communique, ESMA Supervisory briefing on triangular Passporting within the framework of the MiFID II, 17 July 2026: cssf.lu
  • Directive 2014/65/EU (MiFID II), in particular Articles 34, 35, 75, 79 and 86: eur-lex.europa.eu
  • Commission Implementing Regulation (EU) 2017/2382 (passporting notification templates): eur-lex.europa.eu
  • Commission Delegated Regulation (EU) 2017/586 (RTS on exchange of information between NCAs): eur-lex.europa.eu
  • Commission Implementing Regulation (EU) 2017/980 (ITS on cooperation between NCAs): eur-lex.europa.eu
  • Commission Delegated Regulation (EU) 2017/565 (MiFID II Delegated Regulation): eur-lex.europa.eu

Where the triangular passporting file gets tightened

The briefing adds no return to the reporting calendar. It sharpens an existing one: the passporting notification, and the client disclosures around it. If your firm runs a branch or tied agent in one Member State to serve clients in another, the work is to read the notification against ESMA’s expectations, name the triangular route in the file, present the home NCA as supervisor to Member State C clients, and let those clients complain, free and in their own language, into a procedure that already records them. Better as housekeeping now than as an answer to a supervisory question later.

Last updated: July 2026

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.

Similar Posts