The European Banking Authority’s (EBA) consultation could fundamentally reshape how non-EU banks operate in EU markets. It runs until 3 February 2026, with final guidelines expected later in the year and implementation from January 2027. This leaves a narrow window to prepare for a structural shift in supervisory expectations and more cohesive oversight.
Until now, many non-EU banks have operated across EU member states without a physical presence, relying on passporting or local exemptions, but this will no longer be permitted. CRD introduces a harmonised EU-wide framework requiring non-EU banks conducting core banking activities – such as deposit-taking, lending and issuing guarantees – to establish and operate through an authorised branch or, in some cases, a subsidiary in each relevant member state.
Setting up a branch is not a simple formality. It involves a formal application to the national competent authority, including submission of a detailed business plan, governance arrangements, risk management framework and compliance with prudential standards on capital and liquidity. For larger or systemically important operations, regulators may even require subsidiarisation instead of a branch.
This shift means non-EU banks must rethink their European operating model.
Key implications:
To date, the treatment of non-EU branches was fragmented. Each member state applied its own rules, creating inefficiencies and opportunities for regulatory arbitrage. This approach made cross-border oversight complex and raised systemic risk concerns – especially as the largest non-EU banking groups hold most of their EU assets through branches rather than subsidiaries.
CRD VI introduces a harmonised framework designed to strengthen transparency, improve governance, and reduce financial stability risks. It also aligns with Basel III and the broader EU banking package, signalling Europe’s commitment to global supervisory consistency, with improved accountability and greater operational resilience.
The EBA has set out a standardised process for third country authorisations, covering what information firms need to provide, how supervisors will assess applications and the templates to be used. This represents a comprehensive review of a branch’s ability to operate safely and soundly under EU standards.
Applications must include the following:
The guidelines also offer a proportionate approach with scaled-down requirements for smaller branches – but they must still demonstrate prudential soundness. Existing branches will need to be re-authorised or uplift their compliance by January 2027.
In addition to changes in authorisations, there are further amendments for how third-country branches operate under CRD VI, including:
These changes rely on real-time data and automated reporting, which will affect operating models and funding strategies. They may also require further investment in technology and systems.
Standardising the treatment of third-country branches will improve transparency, accountability and supervisory consistency across the EU. However, UK firms with EU customers have significant work ahead to meet the requirements in the short timeframe available, without disruption to ongoing services. To get started, firms will need to consider work on booking controls, governance and management information, in addition to local variation in implementation.
Key activities:
Early movers can turn regulatory change into a differentiator. For example, an application pack that’s aligned to EBA templates will accelerate authorisations in all EU territories – streamlining these activities and reducing the administrative burden.
Similarly, aligning management information with reporting templates will strengthen governance and create a foundation for better analytics. There are also booking processes to consider, and more robust controls will deliver greater insights into branch profitability and risk while also satisfying compliance requirements. Even the non-opposition step (requiring confirmation from home regulators) can nurture a trusting and collaborative relationship with overseas supervisors, turning compliance into a strategic advantage.
For more insight and guidance on third-country authorisations under CRD VI, contact Rashim Arora.
TPR has sharpened expectations for pension scheme administration, highlighting key risks around governance, data integrity and oversight that trustees must act on.
UK crypto regulation is accelerating as the FCA issues new consultations. Learn what firms must do to prepare for authorisation under the incoming regime.
Boards are increasingly being called upon to take ownership of technology risk oversight as a strategic imperative, reinforced by the updated UK Corporate Governance Code and the new Cyber Governance Code of Practice. In 2026, staying ahead of technology risks and regulatory shifts isn’t optional - it’s essential. Are you clear on where to focus to keep your organisation in control?
