Your user in Madrid is European: what the EU will demand from a Latin American app from January

The rule. From 11 January 2027, a firm established outside the European Union that takes deposits from, lends to or issues guarantees for a client established or situated in a Member State must hold an authorised branch in Europe. There are four ways out: the client approached the firm at its own exclusive initiative (and that test is now stricter), the client is a bank, the client belongs to the same group, or the service is ancillary to an investment service. This is Article 21c of Directive (EU) 2024/1619, the sixth Capital Requirements Directive.

So far the conversation about this rule has been led by London and New York law firms, and it is about US banks lending to German corporates or financing Greek shipowners. That is not the region’s case. The region’s case is different: the Colombian woman living in Madrid who still uses her Bogotá bank’s app, the Argentine in Milan who keeps dollars in a Buenos Aires wallet, the Ecuadorian in Barcelona who sends money home through a Quito fintech. For Brussels, all three are European clients. The rule does not look at the passport; it looks at where the client lives.

Who it covers, product by product

Not every app is covered in the same way. What determines the regime is the product, not the brand.

What the app does	EU regime	Who is caught
Account, interest-bearing balance, term deposit, “yield”	CRD VI, Art. 21c, as taking repayable funds	Any non-EU firm, bank or not. No size threshold
Consumer credit, card, buy now pay later	CRD VI, Art. 21c, as lending	Only if the firm would be a “credit institution” in the EU, that is, if it also takes funds from the public. A non-deposit-taking lender is outside under EU law, but Germany, Austria, France and Italy already required a licence under national law
Buying and custody of crypto, stablecoins	MiCA, Art. 61	Already in force. The transitional period closed on 1 July 2026 and ESMA’s reverse solicitation guidelines are the most detailed text that exists on apps
Remittances, payments, wallet without interest-bearing balance	Each Member State’s national payment services regime	Outside Art. 21c; each country decides
Investment in shares or funds	MiFID II, Art. 42, and MiFIR	Retail: each Member State may require a branch unless there is reverse solicitation

Two practical consequences. First: the EUR 30 billion threshold quoted in the press applies only to investment firms; for deposit-taking there is no threshold, and a small fintech from the region is as caught as a global bank. Second: the balance of a wallet that pays yield is deposit-taking, whatever the app calls it.

The two ways out that work for an app

Of the four exemptions, two are for banks (interbank and intragroup) and one is for investment services. An app with ordinary users is left with two.

Reverse solicitation. The client approached “at its own exclusive initiative”. The Directive locks it three ways. First, there is no own initiative if the firm reached the client through an affiliate, an agent, a referrer or anyone acting on its behalf. Second, a client asking for one product does not allow the firm to sell other categories; only what is “necessary for, or closely related to” what was requested. Third, authorities may require the group’s EU entities to hand over information on what the parent provides under this exemption.

What regulators have already said about how it is lost: the European Securities and Markets Authority (ESMA), in its 2025 crypto guidelines, lists “websites, social media platforms, mobile applications” as means of solicitation and recommends, to anyone who wants to be safe, geo-blocking the website and ensuring that “the mobile application was not available for EU countries in mobile applications stores”. The Dutch legislator, when transposing CRD VI, wrote that a tick box saying “I came on my own”, social media advertising and paid influencers all defeat the exemption, and that the firm “must be able to demonstrate” that each relationship started at the client’s initiative. BaFin, since 2005, asks whether the firm “targets” the German market by indicators: language, domain, local contact details, country-specific client information and, above all, the volume of clients from that country.

Contracts entered into before 11 July 2026. The relationship that already existed is protected. That date has passed: no new user can rely on it. And the protection covers the relationship as it was: opening a new product for an old user is new business, and the Netherlands and Belgium have already said that any change creating a new obligation reopens the question.

The hard case: the app is in the store and KYC accepts residents

This is the question we will hear most: the app does no advertising in Europe, but it is available in Spain’s Play Store and onboarding accepts people who live there. Is the exemption enough?

Nobody has decided this under CRD VI. Reading what does exist, the answer has two parts. Being in the store, by itself, is not solicitation: ESMA’s own examples treat as legitimate the client installing the app after asking for the service. What breaks the exemption is what comes next: a push notification two days later offering another product, in ESMA’s literal example, is already solicitation. And an onboarding flow designed for residents of a country, accepting their local ID, their address and their tax residence in their language, is “country-specific client information”: evidence that the country is a target market, not that the clients came on their own.

In product terms: an app open to the world, with generic onboarding and every relationship documented as requested by the client, fits. An app activated in a Member State’s store, with KYC built for its residents, is a business directed at that market, even if it never paid for an ad.

Five decisions the app has to make before January

1. Inventory. How many users reside in the EU, in which country, with which product and since when. Those from before 11 July 2026 are the app’s most valuable asset: they are protected as long as nothing new is sold to them.
2. Evidence per user, not per policy. A letter, an email or a record of the first contact in which the user asks for the product, filed before any commercial communication. The tick box on the form does not work; the Netherlands, Belgium and ESMA have said so.
3. Communications policy towards the EU. No push, emails or campaigns offering another product category to resident users. Renewals and ancillary services, yes.
4. Onboarding. Decide whether the flow accepts European documents and addresses and, if it does, assume that weighs against you. Geo-blocking is the measure the regulator treats as evidence of good faith.
5. Country by country. The Netherlands and Belgium have the strict reading in writing; Austria transposed neither the exemptions nor the protection of existing contracts; Germany already required a licence; Spain had no transposition draft as of September 2026. The same app can be compliant in Lisbon and non-compliant in Amsterdam.

Colombia signed the same rule in 2012

What the EU is turning into a single law for 27 countries is not a 2024 invention. It is the architecture that international trade in financial services has used since the 1997 WTO Understanding: the resident may go abroad to buy banking services; the foreign provider may not come looking for them. The consumption of banking services outside the Union is not affected.

Colombia agreed exactly that with the European Union in the 2012 Trade Agreement. In its schedule of commitments on cross-border supply, for all financial services, Colombia reserved that the commitments “do not impose any obligation to allow non-resident financial service providers to do or advertise business in the territory of Colombia”, and that Colombia “may define ‘doing business’ and ‘advertising’”. The European Union reserved the same towards Chile and Mexico, in the same words. And in banking, neither side bound deposits or loans supplied from abroad; both bound consumption abroad without limits.

That is why Colombia’s regime for the promotion of foreign financial services, which requires the foreign firm to open a representative office and forbids it from taking funds or promoting without one, is the mirror image of Article 21c. The difference is one of date and scale: Colombia has applied its definition for decades; the EU unifies it in 2027. A Latin American app that demands the former from a European competitor cannot be surprised by the latter.

What comes next

Between now and 11 January, Spain, Poland, Portugal, Greece, Romania, Malta and Cyprus still have to transpose. In October ESMA and three national supervisors opened an inquiry into the use of reverse solicitation by the world’s largest crypto exchange. In January the EBA rejected the first formal question on how the exemption applies to syndicated loans, as “not requiring guidance”. Member States are filling the gap, each in its own way.

For a fintech from the region the question is not whether the rule applies. If it has a user in Europe, it applies. The question is whether it can prove, user by user, who came looking for whom.

---

Sources: Directive (EU) 2024/1619, Arts. 21c and 47, recitals 5 and 6; EBA, Report under Article 21c CRD6 (EBA/REP/2025/21, 23 July 2025); ESMA, Guidelines on reverse solicitation under MiCA (ESMA35-1872330276-2030, 2025), paras. 11-17 and 23-25 and Annex; Kamerstuk 36885-3 (explanatory memorandum to the Dutch Capital Requirements Implementation Act 2026), pp. 43-44; BaFin, Merkblatt zur Erlaubnispflicht von grenzüberschreitend betriebenen Geschäften (2005, amended 2019); Freshfields, The impact of the implementation of Article 21c CRD 6 on cross-border lending: four national perspectives (12 October 2026); EY Switzerland, CRD VI Transposition tracker (28 September 2026); Trade Agreement between the European Union and Colombia and Peru (2012), Title IV and Annex VIII, Section A, “12. Financial services”; EU-Chile Interim Trade Agreement (2025), Art. 18.7; EU-Mexico Interim Trade Agreement (signed 22 May 2026), Art. 18.7 and Annex 18-A; WTO, Understanding on Commitments in Financial Services, para. B.4.