Your Broker's Licence Might Live in a Country You've Never Traded From

On 20 July 2026, the European Securities and Markets Authority (ESMA) published its follow-up to a 2022 peer review on how national regulators supervise the cross-border activities of investment firms. The report — covering the Netherlands, Germany, the Czech Republic, Luxembourg, Cyprus and Malta — pressed national competent authorities (NCAs) with large outbound cross-border businesses to make sure their supervision and enforcement actually match the scale of what firms licensed in their jurisdiction are doing elsewhere in the EEA.

Why that matters becomes obvious from ESMA's own cross-border figures. The number of cross-border retail clients served out of Lithuania rose from roughly 500 in 2022 to more than 2.5 million in 2024— a 5,000-fold increase. Over the same period, complaints tied to those relationships went from zero to 1,562. By ESMA's 2024 dataset, Lithuania accounted for 24% of all EU/EEA cross-border retail client relationships — second only to Germany (over 3.5 million) and ahead of Cyprus (more than 2 million). Yet Lithuania had just 16 locally licensed investment firms at the end of 2025.

Almost the entire jump traces to one company. Revolut Securities Europe UAB, incorporated in Vilnius and licensed as a Category B investment firm by the Bank of Lithuania in 2021, launched investment services in March 2023. During that year it migrated in more than 1.1 million EEA-based customers from the group's UK affiliate, Revolut Trading Limited, reaching over 2.5 million customers by year-end. Assets administered grew from €3 billion in 2023 to €9.1 billion in 2024. Much of the “growth,” in other words, was an internal transfer inside the Revolut group — a post-Brexit repapering of clients out of the UK and into an EU-licensed entity that passports its services across the bloc.

This is the clearest recent example of a mechanism most retail traders never see: the single passport. Under MiFID II, a firm authorised by any one EU/EEA national regulator can offer its services in every other member state without seeking a fresh licence in each. The firm's home regulator — here, the Bank of Lithuania — remains its supervisor. The regulators in the countries where its clients actually live (the host states) get notified, but supervision stays with the home authority.

That is why a German, French or Irish trader can end up as the client of a Lithuanian-licensed firm, supervised primarily from Vilnius, without ever choosing Lithuania. It is a deliberate feature of the single market, and passporting itself is neither a loophole nor a warning sign — it is how most pan-European brokers legitimately operate. The concern ESMA is flagging is narrower and more structural: when one small member state suddenly hosts a quarter of the bloc's cross-border retail relationships, does its regulator have the resources and data to supervise millions of clients spread across two dozen countries? A jump from 500 to 2.5 million clients is not something a supervisor scaled for 16 domestic firms can absorb without deliberately expanding capacity — which is precisely what ESMA's report tells NCAs to do.

For a retail forex or CFD trader, the practical read-through is that the brand on the app is not the same thing as the regulator standing behind it. Two brokers with identical marketing can sit under very different supervisory realities depending on which entity holds your account and which home-state authority oversees it. The protections you rely on — investor compensation, segregated client money, a complaints and ombudsman route — attach to that specific licensed entity, not to the logo.

Passporting is fine. Not knowing which entity you've signed with is not. Three checks close most of the uncertainty:

1. 1Find the legal entity on your client agreement.It will name a specific company and its home regulator — for example, “Plus500CY Ltd, regulated by CySEC” or “Revolut Securities Europe UAB, Bank of Lithuania.” That entity, not the brand, is what determines your protections.
2. 2Verify it on the home regulator's own register. Every EU/EEA supervisor publishes a public database — the CySEC register, BaFin, the Bank of Lithuania, or via ESMA's registers. If the entity holding your money isn't there, the protections you assume you have don't exist.
3. 3Confirm the compensation scheme in writing.An EU retail account should disclose coverage under the home state's investor-compensation scheme — for CySEC firms, the Investor Compensation Fund up to €20,000; comparable national schemes elsewhere. If the paperwork is silent, ask before you fund.

None of this is a mark against Lithuania, Cyprus or passporting. It is a reminder that “EU-regulated” is not a single uniform stamp — it is a pointer to a specific national authority whose capacity and scrutiny you can, and should, check. The brokers that make this easy tend to be the ones worth trusting: they name the EU entity plainly, cite the licence number, and disclose the compensation scheme up front.

That transparency is the standard to hold any broker to. Pepperstone serves EU clients through Pepperstone EU Ltd under CySEC (388/20), with ICF coverage up to €20,000 and segregated funds; eToro operates its EU business through eToro (Europe) Ltd under CySEC (109/10); and Plus500 routes EU clients through Plus500CY Ltd (CySEC 250/14). In each case the licensed entity, its home regulator and its compensation scheme are stated openly — which is exactly what you want to be able to see before a jurisdiction you've never traded from becomes the one supervising your money.