BaFin Warns of a Supervisory Race to the Bottom - What EU Traders Should Take From It

What BaFin actually said

Thorsten Pötzsch, chief executive director for securities supervision at Germany's Federal Financial Supervisory Authority (BaFin), told a capital-markets conference in Frankfurt on 9 September 2026 that firms with digital business models deliberately establish themselves where EU supervision is weakest, then expand across the bloc. "We cannot let that happen," he said, adding that financial centres should not "engage in a race to the bottom to attract financial firms." The event was hosted by the bwf banking association and ICMA.

Pötzsch named no company and no sector. But the mechanism he described is familiar to anyone who has compared broker licences: under the EU's single-market framework, authorisation in one member state lets a firm passport its services into the other 26 without a fresh licence in each. That is by design - it is the foundation of the single market in financial services - but it also means a firm operating EU-wide can face up to 27 different supervisory approaches to a single rulebook.

The passporting mechanism, in plain terms

Most retail forex and CFD brokers serving the European Economic Area hold a single MiFID II licence from one national competent authority and passport it everywhere else. The Cyprus Securities and Exchange Commission (CySEC) is the most common home regulator for this model; others authorise in Ireland, Malta, Germany or the Baltic states and passport outward from there.

The rulebook the firm must follow - MiFID II, plus the ESMA product-intervention measures on CFDs - is the same regardless of which authority issues the licence. What varies is the intensity of ongoing supervision: how closely the home regulator polices marketing, client-money segregation, complaint handling and financial-promotion rules in practice. Pötzsch's argument is that some firms shop for the home regulator that supervises those obligations most lightly, then rely on passporting to reach the whole bloc.

BaFin pointed to its own footprint as evidence the imbalance is real rather than rhetorical. According to FM Intelligence data cited at the conference, German entities hold 22.0 per cent of authorised crypto-asset service providers but account for only 7.2 per cent of declared host-state links - a gap that suggests activity is being booked where oversight is lighter and delivered elsewhere.

The proposed fix: direct ESMA supervision

Pötzsch backed a European Commission plan, debated since November 2025, to give the European Securities and Markets Authority (ESMA) direct supervision of crypto and stock markets rather than leaving enforcement to 27 national bodies. Notably, George Theocharides, chairman of CySEC - the very regulator most closely associated with the passported-broker model - backed the same centralisation push, arguing for a level playing field.

That two of the EU's most relevant securities supervisors publicly agree is significant. It signals the direction of travel: over the coming years, expect more of the supervision that today sits with national regulators to migrate towards ESMA, at least for cross-border digital-asset and market activity. Pötzsch coupled that with a warning that the forthcoming MiCA review "must not become an exercise in deregulation," and criticised MiFID II's complexity - he counted "263 additional legal acts" at Levels 2 and 3 - as an example of rules that may not improve investor protection in proportion to their cost.

Why this matters when you pick a broker

None of this changes the leverage caps or the core protections. The ESMA retail measures - 30:1 on major currency pairs, 20:1 on minor pairs, gold and major indices, 10:1 on other commodities and non-major indices, 5:1 on individual equities and 2:1 on cryptocurrency CFDs, plus mandatory negative-balance protection - apply uniformly to any firm serving EEA retail clients, whichever national authority issued its licence. A CySEC-passported broker and a BaFin-authorised one owe you the same statutory floor.

What the supervisory debate does underline is that the licence entity matters more than the brand. Two things vary in ways that affect you directly. First, the investor-compensation scheme is set by the home state: the Investor Compensation Fund in Cyprus covers eligible claims up to EUR 20,000, whereas the UK's Financial Services Compensation Scheme covers up to GBP 85,000 for FCA-authorised firms. Second, how vigorously your home regulator polices misconduct - the exact concern Pötzsch raised - can shape how quickly problems get caught.

The practical defence is the same one we give on every broker page: before funding an account, read the client agreement and confirm which legal entity you are contracting with, then look that entity up on the relevant public register. The CySEC register, BaFin's company database and the FCA register are all free to search. A well-known brand can operate through several entities with very different protections; the licence number on your agreement is what counts.

Two supervisory gaps the conference flagged

Beyond passporting, Pötzsch and other speakers highlighted areas where oversight has not yet caught up with the market. Prediction markets are one: ESMA said in July 2026 that event contracts can fall under the EU retail ban on binary options, Spain opened proceedings against Kalshi and Polymarket in May, nine national regulators issued a joint warning in June, and Malta is drafting dedicated rules. Retail proprietary trading is another - as of June 2026, Theocharides said ESMA was not in substantive discussions on it, citing its limited size, even as prop-firm and broker models increasingly converge.

On stablecoins, Pötzsch was blunter. He opposed multi-issuer arrangements, where the same token is issued by both an EU entity and a third-country entity: "We therefore firmly oppose these models." That aligns BaFin with the European Central Bank and the European Systemic Risk Board, which recommended in September 2025 that such structures be restricted or ruled out; MiCA does not currently address joint issuance. Roughly 80 per cent of registered crypto firms dropped out under a compliance cull, a figure that gives a sense of how much the sector has been reshaped by tighter enforcement.

What it signals for the year ahead

The direction is towards more centralised, more uniform supervision of cross-border financial activity in the EU - not less. For traders, that is broadly good news: the more consistently the single rulebook is enforced, the less the choice of home regulator should matter, and the harder it becomes for a firm to run a light-touch operation from a permissive base.

In the meantime, the burden of due diligence still sits with the client. The protections written into MiFID II and the ESMA measures are strong, but they only reach you through an authorised entity that actually observes them. Trading CFDs remains high-risk regardless of supervisor: between 74 and 89 per cent of retail investor accounts lose money, according to disclosures required by ESMA. Choosing a broker with a transparent, well-supervised licence does not change those odds - it changes what recourse you have if something goes wrong.