Licensing a brokerage app in the EU: investment firm or tied agent
What MiFID II asks of a retail trading app in the EU: the services it provides, initial capital, client assets, KIDs, appropriateness and the tied agent route.
To its users, a trading app looks like an exchange. In EU law it is usually something else: an investment firm that receives, passes on or executes its clients' orders, and often holds their money and securities. The rules are in MiFID II (Directive 2014/65/EU) and MiFIR (Regulation (EU) No 600/2014), with capital set by the Investment Firms Directive (IFD).
This guide is general information, not legal advice: the details depend on your services and your market, so confirm them with a lawyer and the regulator before you apply.
Trading venue or trading app
Trading venues are regulated markets, multilateral trading facilities (MTFs) and organised trading facilities (OTFs), each bringing together multiple third parties' buying and selling interests. A market operator runs a regulated market; an investment firm or a market operator runs an MTF; an OTF is limited to bonds, structured finance products, emission allowances and derivatives, so no shares (Article 4(1), points 21 to 24).
A retail trading app is run by an investment firm providing investment services (Annex I): reception and transmission of orders, which passes clients' orders on for execution; execution of orders on behalf of clients; and dealing on own account, if the firm takes the other side. Safekeeping clients' securities is an ancillary service, and no firm is authorised for ancillary services alone (Article 6(1)).
The line matters if your app has its own order book. Any system where multiple third parties' trading interests can interact is a multilateral system, and it must operate as a regulated market, an MTF or an OTF (MiFIR Articles 1(5b) and 2(1)(11)). Matching your clients' orders against each other is venue business, not brokerage.
Who regulates it, and where
You apply to the competent authority of your home member state, and a firm that is a legal person must have its head office in the country of its registered office (Article 5). ESMA publishes a list of all EU investment firms and their services. The authorisation is valid across the EU (Article 6(3)), and MiFID II is part of the EEA Agreement.
Capital by activity
IFD Article 9 sets initial capital by what the firm is authorised to do:
Authorisation | Initial capital |
|---|---|
Reception and transmission, execution, portfolio management, advice or placing without firm commitment, with no permission to hold client money or securities | €75,000 |
Dealing on own account, or underwriting or placing on a firm commitment basis | €750,000 |
Operating an OTF, where the firm deals or may deal on own account | €750,000 |
Every other investment firm, including brokers that hold client assets and MTF operators | €150,000 |
Afterwards, own funds must cover the highest of that permanent minimum, a quarter of the previous year's fixed overheads and, unless the firm is small and non-interconnected, a K-factor requirement based on client money, assets and orders (IFR Articles 11 to 15).
People, AML and technology
Management: at least two people effectively direct the business, each of good repute with enough knowledge, skills, experience and time, and qualifying shareholders must be suitable (Articles 9 and 10).
AML: investment firms are obliged entities under the Anti-Money Laundering Directive, and the AML Regulation applies from 10 July 2027.
Technology and outsourcing: DORA has applied to investment firms since 17 January 2025 (Articles 2 and 64). Outsourcing important functions may not impair internal control or supervision (MiFID II Article 16(5)). A firm using ICT providers stays fully responsible for compliance, keeps a register of those contracts and writes required terms into them (DORA Articles 28 and 30).
Client assets
A firm holding client money or securities must protect clients' ownership, especially in its insolvency. It may not use clients' money for its own account, or their securities without express consent, and may not take title transfer collateral from retail clients (Article 16(8) to (10)). The delegated directive on safeguarding adds:
records separating each client's assets from other clients' and the firm's, regularly reconciled with the third parties holding them;
client money placed promptly with a central bank, a credit institution, an authorised third-country bank or a qualifying money market fund, normally no more than 20% of it at group entities;
securities deposited with third parties subject to safekeeping regulation and supervision, in separately identifiable accounts;
one officer responsible for safeguarding, and an external auditor's report to the authority at least yearly.
Key information documents
Packaged products sold to retail investors need a key information document (KID) of at most three A4 sides under the PRIIPs Regulation. The manufacturer writes it; whoever sells or advises must give it to the investor in good time before they are bound (Articles 5 and 13). Funds and structured products are in scope, while assets held directly, such as shares or government bonds, are not (recitals 6 and 7). The KID rules also cover derivatives such as options and CFDs (Delegated Regulation (EU) 2017/653, Annex II), and UCITS funds have been in scope since their exemption ended on 31 December 2022 (Article 32).
The Commission's guidelines add that the KID is due whether or not advice is given, and that non-EU products sold to EU retail investors need one too.
Appropriateness for complex products
Unless advising or managing a portfolio, a firm must ask clients about their knowledge and experience of the product or service, and warn them if it is not appropriate or if they gave too little information (Article 25(3)).
The execution-only exemption covers only non-complex instruments, such as listed shares, plain listed bonds and UCITS, and only when the client initiates the service and is told the firm is not assessing appropriateness (Article 25(4)). Derivatives cannot qualify as non-complex (Delegated Regulation (EU) 2017/565, Article 57), so options, futures and CFDs always need the test in a non-advised app.
ESMA's guidelines on appropriateness spell out the practice: do not discourage clients from answering, make warnings prominent and clear, avoid wording such as "may not be appropriate", and do not nudge clients to proceed, retake the test or ask to be treated as professionals.
The Retail Investment Strategy would amend MiFID II and the PRIIPs Regulation: Parliament's committee approved the agreed texts on 23 June 2026, and a plenary vote is indicated for 11 November 2026 (Legislative Observatory: MiFID II changes, PRIIPs changes).
Steps and timelines
Define the services: reception and transmission, execution, dealing on own account, custody. These set the licence and capital.
Build the file: a programme of operations covering the business and the organisational structure (Article 7(2)).
Wait for the decision: the authority must tell you within six months of a complete application whether you are authorised (Article 7(3)).
Passport: notify your home authority, which forwards the notification within one month; you may then start in the host country (Article 34).
Launching on a licensed firm's licence
A tied agent acts under the full and unconditional responsibility of one investment firm only. It may promote the firm's services, receive and transmit client orders, place financial instruments and give advice on the firm's products (Articles 4(1)(29) and 29(1)).
The firm stays fully responsible for the agent, monitors it, and makes sure it tells every client whom it represents.
The agent must be on the public register of the member state where it is established, which admits only agents of good repute with the necessary knowledge and competence.
An agent may hold client money or securities only where national law allows it, and countries may add stricter rules (Article 29(2) to (6)).
Tied agents in other countries are part of the firm's passport notification (Articles 34 and 35).
Some brokers instead serve clients under your brand and contract with them directly. If your company promotes the services, receives orders or advises, those are tied agent activities. Either way, the broker's authorisation must cover every service your app offers, in every country you serve.
Common mistakes
An order book under a brokerage licence. It needs venue authorisation.
Payment for order flow. MiFIR bans it for firms acting for retail clients (Article 39a). Countries where firms already took it could exempt them until 30 June 2026; that window has closed (ESMA list).
Listing products without a KID for retail investors.
Adding crypto without permission. An investment firm can offer equivalent crypto-asset services by notifying its authority at least 40 working days ahead (MiCA Article 60(3)); see the MiCA checklist.
What this means for your platform
Our white-label stock exchange platform has both pieces. Its matching engine runs an order book, which in the EU belongs inside a regulated market, an MTF or an OTF. For a brokerage, the portfolios module connects to brokers and custodians that execute trades and hold assets under their own licence, or to your own execution and custody once you are authorised. Onboarding asks about experience and goals before products open up, and the KYC/AML and compliance-reporting modules are built in. We configure the platform to match your authorisation.
Sources
All checked on 6 October 2026.
