CRD VI: The EU's Cross-border Banking Rules Are Changing For Non-EU Institutions. Are You Ready?

With the EU's new third-country branch regime taking effect on 11 January 2027, CRD VI is set to reshape how non-EU banks operate and serve EU clients. While national transposition and the policy landscape continue to take shape, impacted institutions still have time to assess their activities, applicable exemptions, and the suitability of their European operating models.

Our insight identifies key implications and practical next steps for non-EU institutions that will continue to originate, participate in, amend or service EU clients under the new regime.

The Regulatory Shift

Before CRD VI, the regulatory treatment of cross-border banking services by non-EU institutions varied significantly across the EU. Some Member States permitted a relatively broad range of cross-border activity, while others applied strict banking monopoly rules. This created a patchwork of national regimes and required institutions to assess market access country by country.

CRD VI establishes a common baseline and was adopted alongside the third Capital Requirements Regulation (CRR III) as part of the European Union's implementation of the final Basel III reforms. Although CRD VI contains wider measures on governance, prudential supervision, risk management and bank transactions, Article 21c is of particular importance to non-EU banks and financial institutions.

Namely, it introduces a harmonised minimum framework under which a third-country institution may no longer provide specified core banking services to a client in an EU Member State unless it has an authorised branch in that Member State, operates through an EU-licensed subsidiary or falls within limited exemptions.

Because CRD VI is a directive, each Member State must transpose it into national law. Harmonisation is therefore the objective, but the precise result will continue to depend on national legislation, local regulatory guidance and any gold-plating adopted by individual Member States. Institutions should therefore avoid treating CRD VI as a single, uniform licensing answer for all EU business operations.

Key Dates

What Activities Are Captured?

The principal activities captured under the new EU regime include:

• Taking deposits or other repayable funds.
• Guarantees and commitments.

The identity of the service provider matters. The detailed CRD VI and CRR definitions determine whether an entity is a credit institution or another in-scope institution. This can produce different outcomes for banks, investment firms, funds and other non-bank lenders.

Lending is likely to remain the most fact-sensitive category. National laws do not apply a completely uniform concept of lending, and Member States may take different approaches to loan origination, assignments, novations, participations, and fully drawn loans. The relevant borrower nexus and the location in which the service is considered to be provided must also be analysed under local law.

Branch or Subsidiary?

Impacted institutions that require authorisation will need to decide whether to establish one or more third-country branches or operate through an EU-licensed subsidiary.

The appropriate model will depend on the institution's existing EU footprint, client base, target jurisdictions, product strategy, governance capability and cost of implementation. Authorisation processes require substantive documentation and regulatory engagement, so institutions that may need a new structure should begin planning promptly.

What are the Key Exemptions?

Although the branch requirement is broad, CRD VI retains certain limited exemptions. Each should be applied narrowly and tested against national implementing law.

Reverse solicitation

The exemption may apply where an EU client approaches the third-country institution on the client's own exclusive initiative. It is not intended to provide a general business model for systematic EU market access. Prior marketing, solicitation through an intermediary or broader product promotion may undermine reliance on the exemption. The exemption is generally limited to the service or product requested by the client, and records supporting the client-led approach will be important.

Interbank services

Services provided to EU credit institutions may fall outside the branch requirement. This can support structures in which an EU-authorised bank faces the EU borrower while a non-EU bank participates behind the scenes through a funded or unfunded risk participation. The client-facing relationship and the local-law treatment of the arrangement remain important.

Intragroup services

Services provided within the same group may qualify for an exemption. Institutions carrying on both intragroup and external client business should clearly separate the relevant activities and document the basis on which the exemption is used.

MiFID services carve-out

Investment services and activities governed by MiFID remain subject to that separate framework. Where deposit-taking or lending is genuinely ancillary to the MiFID service, the Article 21c branch requirement may not apply. This may be relevant to investment firms and private banks, but the substance and relative importance of the lending activity should be assessed carefully.

Grandfathering & Loan Lifecycle Events

Contracts concluded before 11 July 2026 may continue to be serviced under the grandfathering regime. The fact that a facility predates the cut-off does not, however, resolve every issue. Amendments and later lifecycle events may be treated as creating a new contract or a new funding commitment. To ensure compliance, in-scope institutions should assess material amendments and transfers under the implementing law of each relevant Member State.

Action Items: What Should Non-EU Institutions Do Now?

The 11 July 2026 grandfathering cut-off has passed and the Article 21c regime is due to apply from 11 January 2027. Institutions that continue to originate, participate in, amend or service EU transactions should now complete their perimeter assessment and operating-model decisions, which include:

• Creating a complete inventory of EU-facing activities and classifying each against the core banking services perimeter.
• Identifying contracts potentially protected by the 11 July 2026 grandfathering cut-off and establishing controls for amendments, transfers, increases and extensions.
• Testing the availability of exemptions and retaining evidence supporting reliance on them.
• Conducting a priority jurisdiction-by-jurisdiction analysis.
• Deciding whether the target operating model should use existing EU entities, one or more third-country branches, an EU subsidiary, or interbank structures.
• Monitoring transposition developments and guidance from national authorities, the EBA, the ECB and other relevant European bodies.