CRD 6: Key Implementation Differences Across the EEA

For third-country institutions looking to provide core banking services into the EEA Member States, understanding how Directive 2024/1619 (CRD 6) is being implemented at national level is critical. Whilst CRD 6 aims to introduce a harmonised framework governing the provision of core banking services by third-country institutions across the EU, it is becoming clear that there are material differences in how Member States are embedding the regime into existing frameworks, interpreting core banking services and applying transitional arrangements. In this article, which is our first in a series in which we will do a deeper dive on various aspects of implementation, we highlight some differences in approach being taken by various Member States to implementing the third-country branch requirement into their national laws.

Third-country branch requirement in a nutshell

For anyone new to the topic, CRD 6 amends the Capital Requirements Directive (2013/36/EU) (CRD) by introducing a requirement for EU Member States to require third-country institutions to establish an authorised third-country branch to carry out certain core banking services in the Member State (Authorised TCB Requirement), unless an exemption applies. These exemptions, although limited, ensure that activities: (i) requested by the client at its exclusive initiative, (ii) with a client or counterparty that is a credit institution, (iii) with a member of the same group as the third-country institution, and (iv) that are ancillary to core MiFID services and activities, are excluded from scope.

Progress in implementation

Member States were expected to adopt and publish measures implementing CRD 6 by 10 January 2026. Notwithstanding this, progress on implementation remains patchy across the Member States and the European Commission has opened infringement proceedings against 22 EU Member States for failure to communicate CRD 6 transposition measures.

A number of jurisdictions have already completed their CRD 6 transposition process, including the Czech Republic, Denmark, France, Germany, Italy, Luxembourg and Sweden. A number are well on their way: in the Netherlands and Finland, draft legislation has been approved by parliament and is now awaiting signature/confirmation and publication in an official gazette, while Belgium, Poland and Norway have published draft legislation which is progressing through the legislative process (although for Norway, entry into force of the legislation is dependent on incorporation of CRD 6 into the EEA agreement, which is still pending). However, a number of jurisdictions are lagging behind, with Spain, Portugal, Iceland and Ireland having not yet, as at the date of this article, adopted or published final implementing legislation.

Timing of application of requirements

Across most jurisdictions, the Authorised TCB Requirement will enter into force on 11 January 2027, as envisaged under CRD 6. There are a few outliers, however:

• in the Czech Republic, CRD 6 was implemented one year earlier - on 11 January 2026

• in Denmark, the Authorised TCB Requirement will apply from 1 January 2027 (reflecting a domestic legislative commencement practice)

Iceland has also recently announced that implementation of CRD 6 has been delayed by a year, with legislation expected to enter into force in Q3 2027.

Overarching implementation approach

How each jurisdiction is approaching implementation of CRD 6 varies depending on its existing regime. Broadly speaking, across the EU, there is currently a range of national regimes that apply to lending activities, including:

• more permissive frameworks, where cross-border lending is generally permitted or permitted to certain types of borrowers e.g. Belgium, Denmark, Iceland, Ireland and the Netherlands

• more restrictive frameworks, where lending already triggers a requirement for a licence/authorisation, such as Austria, France, Germany, Italy, Norway, Poland and Portugal (although in a number of these, there are useful exemptions available e.g. in Germany, a non-EEA entity can apply to BaFin for an exemption order in certain circumstances)

Deposit-taking is already highly restricted in most EEA jurisdictions without a licence/authorisation.

CRD 6 is therefore being implemented in different ways, depending on the existing national regimes. A few examples:

• in Germany, lending is already restricted and the exemptions are already largely reflected in German law. Consequently, the German law implementing CRD 6 (the Banking Directive Implementation and Bureaucracy Reduction Act or BRUBEG) does not include the CRD 6 exemptions to the extent they are already provided for in German law

• similarly, in Austria, the explanatory report accompanying the draft law notes that there is no need for implementation of the provisions of CRD 6 related to the Authorised TCB Requirement and exemptions because it is already implemented through the overall framework of Austria’s Banking Act

• in France, lending is already restricted, so the main change made by France’s implementing ordinance is to introduce the CRD 6 exemptions into national law

• in contrast, in the Netherlands, where lending is generally permitted except to consumers, the draft implementing legislation introduces a new requirement for an authorised branch for the provision of core banking services and also the CRD 6 exemptions

What does “core banking services” capture?

A key point of divergence lies in how Member States are interpreting the core banking services. As a reminder, under CRD 6, the Authorised TCB Requirement is triggered by the carrying on in an EU Member State of the “core banking services” of:

• taking deposits and other repayable funds (i.e. activities under Annex I, point 1 of CRD) by any third-country undertaking

• lending and guarantees and commitments (i.e. activities under Annex I, points 2 and 6 of CRD) by any third-country undertaking that would qualify as a credit institution or meet certain criteria in the Capital Requirements Regulation (EU) No 575/2013 (CRR) relating to large investment firms if established in the EU

Most jurisdictions are transposing the concept of core banking services in line with CRD 6, whether by directly referring to Annex I of CRD (e.g. Germany, Sweden) or referring to services corresponding to those services as implemented in existing law (e.g. Italy, Poland). However, the scope of core banking services can vary depending on domestic interpretation of these services. For example:

• in Germany, although the BRUBEG refers to the activities as set out in CRD 6, counsel has confirmed that these concepts will likely be interpreted in line with existing German concepts of “deposit business”, “lending business” and “guarantee business”, which differ in scope in some respects e.g. the German interpretation of “lending business” does not include factoring and forfeiting (these are separate licensable activities under German law)

• in Poland, the draft act refers to banking activities as set out in existing provisions of the Banking Law. While counsel has confirmed that these largely correspond with the core banking services in CRD 6, there are differences, for example, factoring and forfeiting fall outside core banking services and are regulated separately

• in a number of jurisdictions, such as the Czech Republic and Germany, the issuance of debt securities can qualify as deposit-taking in certain circumstances and therefore potentially trigger the Authorised TCB Requirement. Similarly, in Italy, the issuance of bonds and other debt securities has historically been viewed as a form of deposit-taking, and counsel considers it possible that the Bank of Italy will continue to view such activity as falling within deposit-taking thereby triggering the Authorised TCB Requirement

• in relation to Norway, while counsel has confirmed, based on the Ministry of Finance consultation (published in February 2025), that the concept of core banking services is in line with CRD 6, counsel expects the requirement to apply to a wider range of financing activities in practice

Some jurisdictions are overlaying domestic requirements that do not exist in CRD 6. In Germany, activities falling in scope of the core banking services will only trigger a licensing requirement where they are provided commercially or to an extent that requires a commercially organised business operation (this position is already established in German law and the BRUBEG/CRD 6 does not change that position). This means that certain very low-level activities do not trigger a licence requirement in Germany.

Final thoughts

Although a harmonised framework governing the provision of core banking services by third-country institutions across the EU is intended and we are seeing convergence around key elements such as requiring a branch for provision of core banking services and timing of application, there remains divergence in approach across certain key areas. As a result, firms cannot approach CRD 6 compliance on a pan-European basis but instead, effective implementation requires a jurisdiction-by-jurisdiction analysis.