• Starting on 11 January 2027, non-EU banks will require an authorised and regulated EU branch to lend or provide guarantees to, or take deposits from, EU clients, unless one of a handful of exemptions apply.
• Due to the existing strict German banking monopoly, the effects on German business will be less pronounced as for other EU countries, except for those firms currently operating under a BaFin waiver for the abovementioned activities.

With some delay, the German government published the draft of the Banking Directive Implementation and Bureaucracy Reduction Act (Bankenrichtlinienumsetzungs- und Bürokratieentlastungsgesetz – “Governmental Draft”) on 10 October 2025 to implement Directive (EU) 2024/1619. This directive amending Directive 2013/36/EU as regards supervisory powers, sanctions, third-country branches, and environmental, social and governance risks, also known as Capital Requirements Directive IV (the “CRD VI”), must be implemented into national law by 10 January 2026.

It covers topics such as a new regime for assessing the suitability of senior management and key function holders and inclusion of short-, medium- and long-term ESG risks (including those derived from the EU’s objective to achieve climate neutrality by 2050) in capital adequacy assessment, risk management and remuneration policies. Supervisors will assess the relevant plans, timelines, quantifiable targets and milestones and have supervisory powers to require a reduction of ESG risk. CRD VI is, together with the related Capital Requirements Regulation (the “CRR”), the final step in implementing the Basel III program to strengthen bank capital requirements and improve the resilience of the banking sector.

This Update will focus on the EU’s new minimum requirements for authorisation and supervision of third-country banks’ EU branches and limitations on third-country banks providing banking services outside the EU to EU customers (cross-border banking services) – a topic so far left to the national law of each member state. Those rules (except reporting certain obligations for EU branches) apply from 11 January 2027.

Cross-Border Core Banking Services

Non-EU (third-country) entities will be prohibited from engaging in cross-border core banking business in the EU, unless an exemption applies. Core banking services are:

• accepting deposits or other repayable funds; and

• lending or providing guarantees or commitments.

Under the new regime, deposit taking is generally prohibited on a cross-border basis, whilst lending and providing guarantees or commitments is only prohibited for third-country entities that would qualify as a credit institution (lending and deposit business) or a large, systemic investment firm (as defined in the CRR) if they were established in the EU. That does notably not include investment funds and fund managers or insurance companies.

The exemptions from the prohibition to engage in cross-border core banking business are as follows:

• Reverse solicitation: where a client or counterparty (including a retail client) approaches the third-country entity at its own exclusive initiative for the provision or continuation of banking services or banking services closely related to those solicited; reverse solicitation is not available where a third-country entity solicits the client through an entity with which it has close links or which is acting on its behalf;

• Inter-bank business: services provided to another credit institution;

• Group exemption: services provided to an affiliate; or

• MiFID ancillary services: services provided as ancillary to a MiFID service, e.g., granting credits or loans to carry out a capital markets transaction.

From 2027, a third-country undertaking that wants to continue to provide core banking activities in the EU will need to establish an authorised and supervised EU branch (a third-country branch or “TCB”) or an EU subsidiary. Under CRD VI, an authorised branch will be subject to lighter supervision, although member states have the option to apply the full banking regime. Branches are not able to obtain passports into other EU member states.

It remains to be seen if different member states take different interpretations. Germany has taken the view that “providing services” in Germany includes services provided from a German establishment, as well as cross-border targeted at the German market. Other member states have taken the approach that the service is provided where the main activity takes place, even if the client is domiciled elsewhere. The same behaviour could be seen as providing core banking services outside the EU by some member states while other member states may consider the same fact pattern a cross-border service only permitted without TCB if an exemption is available.

European borrowers, or clients of other core banking services, which have entered into arrangements with third-country banks, should be prepared for requests from those banks to change arrangements to adjust to CRD VI. As a result of the new regime, there will be opportunities for non-bank lenders, such as credit funds.

The new regime is without prejudice to existing contracts entered into before 11 July 2026. This grandfathering is not included in the Governmental Draft, but the existence is recognised in the explanatory notes.

EU Branches of Third-Country Banks

Third-country undertakings providing core banking services through a third-country branch will be required to apply for authorisation from an EU competent authority and will be subject to supervision by the national regulator and additional regulatory requirements, including regarding minimum capital endowment, liquidity, book-keeping and reporting. Those requirements differentiate between large and/or high-risk “class 1” and smaller and low risk “class 2” TCBs. A further category is the “qualifying TCB” based on the comparability of the regulatory regime applicable to the third-country head undertaking to the EU regime. The competent authority can exempt qualifying TCBs from liquidity requirements and certain reporting obligations.

As above, an EU branch does not benefit from the passport to perform services on a cross-border basis, except within its group or on reverse solicitation basis.

Competent authorities have the power to require EU branches of third-country undertakings to establish an EU subsidiary with authorisation as credit institution if the branch is systemically important, its assets on a stand-alone basis or together with all TCBs of the same third-country group exceed certain thresholds or if the TCB performs cross-border services.

Notable Points on German Implementation

Lending in Germany is, with some exemptions, already subject to a bank monopoly. Third-country undertakings, and not only third-country banks or systemic investment firms as envisaged in CRD VI, lending or otherwise providing banking services in Germany must establish a branch in Germany that is subject to authorisation and regulatory requirements. Accordingly, the adaptation for lenders already active in the German market is less burdensome. The Governmental Draft clarifies that BaFin can decide that already authorised branches can continue under their existing authorisation if they materially comply with the new requirements.

For this reason, the Governmental Draft does not prohibit the provision of cross-border core banking services because this has not been permitted to date in Germany. A group exemption already exists in the German Banking Act and, according to regulatory practice, neither providing banking services of lending or deposit taking to a German CRR credit institution nor reacting to reverse solicitation requires an authorisation. However, some concerns have been voiced in the market that the existing exemptions the Governmental Draft is relying on might not perfectly align with those set out in CRD VI.

What Is Lending?

Whilst the term “lending” is not defined at EU level, the German regulator BaFin had published guidance setting out long-standing administrative practice on the interpretation of lending and deposit taking. Many market participants have worked with those definitions to operate without authorisation to structure loans that are technically not loans, at least from a regulatory perspective. Examples are certain deeply subordinated loans, participating in a loan syndication with an authorised lead arranger, shareholder loans and purchase of loan receivables under fronting arrangements. It cannot be excluded that EU regulators, with lending gaining attention on the EU level, may make statements on lending that challenge BaFin’s administrative practice. Market participants engaging in those activities should carefully pay attention to future developments in this space.

Waivers

Non-EU firms engaging in banking and investment business in Germany on a cross-border basis may, on a case-by-case basis, obtain a waiver from German authorisation and most other regulatory requirements, but remain subject to some obligations, provided they are sufficiently supervised by their home state regulator. This waiver has been used, amongst others, by Swiss and US firms. The Governmental Draft clarifies that waivers can no longer be granted for core banking activities and third-country undertakings are no longer permitted to provide core banking activities on a cross-border basis under CRD VI. Existing waivers will have to be partially retracted to the extent they include core banking activities.

Next Steps

This publication is for general information purposes only. It is not intended to provide, nor is it to be used as, a substitute for legal advice. In some jurisdictions it may be considered attorney advertising.