ESMA cross-border report: Cyprus is home to a fifth of EU passporting firms

Each year ESMA and the national supervisors collect data on investment services that firms provide to retail clients in other EU/EEA countries under the freedom to provide services, the passport set out in Article 34 of MiFID II. The report does not cover services in a firm's home country or through branches, and it counts only firms with more than 50 retail clients in a host country. Firms below that threshold everywhere did not have to provide data.

For the reference year 2025, the data were collected between February and April 2026 from firms in 30 EU/EEA jurisdictions. National supervisors validated what firms submitted and sent it to ESMA, and all 30 responded.

Across the EU/EEA, firms reported about 15.5 million cross-border retail clients, 47% more than in 2024 (10.5 million) and 94% more than in 2023 (8 million). ESMA notes that this is not a count of unique investors, as one person may hold several accounts. The number of firms rose from 370 to 379, while complaints were stable at 10,945, against 10,968 in 2024. Complaints per 100,000 clients therefore fell from 104 to 71, though ESMA says this should be read with caution.

Cyprus is again the main home of firms providing cross-border investment services. It reported 78 of the 379 firms, about a fifth and one fewer than in 2024, ahead of Luxembourg with 55 and Germany with 44. Cyprus is home to the largest number of investment firms in this group, 76, which is 35% of all EU/EEA investment firms providing services across borders. Two Cyprus firms serve retail clients in all 29 other EU/EEA countries.

Cyprus firms served about 4.2 million cross-border retail clients, up from 3.6 million in 2024 and about 27% of the EU/EEA total. In 2025 Lithuania overtook Cyprus as the country whose firms serve the most cross-border clients, with 4.9 million. Two of the five firms with the most cross-border clients in the EU/EEA are based in Cyprus.

Cyprus firms received 1,908 complaints, 17% of the total and 73% more than in 2024. Together with Ireland, Lithuania and Germany, Cyprus accounts for 82% of all complaints about cross-border services.

The cross-border model is mainly execution. Execution services reached 87% of active clients, portfolio management 11% and investment advice only 0.8%. By product, shares were held by 7.3 million clients and UCITS by 6 million, crypto-assets regulated under MiCA by nearly 1.6 million and CFDs by about 1.3 million. France, Spain, Germany and Italy are the main destinations, with 52% of all cross-border retail clients between them.

On complaints, firms most often classified them as "Other", followed by general administrative or customer services and terms of contract or fees. ESMA says this suggests the reported topics may be unreliable because some firms may not classify complaints consistently. In 54% of complaints no specific product was recorded, and among the rest shares came first and CFDs second.

The report creates no new obligation and no deadline. It is an evidence base for supervisors. ESMA recalls that the home supervisor is responsible for supervising cross-border services and for passing information to host supervisors. ESMA adds that the concentration of clients in a few firms lets supervisors take a more targeted, risk-based approach. For the passport itself, see our study note on CIF authorisation, and for home and host co-operation, our note on CySEC supervision and co-operation.

ESMA will run its next data collection in 2027. In this year's exercise only firms with more than 50 retail clients in a host country had to report. Firms may want to compare their own figures with the Cyprus results and make sure their complaint records are classified consistently by topic and product. ESMA will review the exercise in light of the new MiFID II reporting framework for cross-border services required by the Retail Investment Strategy, and the report gives no date for that framework.