Implementation of CRD VI: new requirements for third-country undertakings seeking to provide banking services in Sweden

On 3 June 2026, the Swedish Parliament (Sw. Riksdagen) adopted the Government’s proposal in Government Bill 2025/26:253 on the EU Banking Package, with the adjustments set out in the report of the Committee on Finance, which means that the EU’s sixth Capital Requirements Directive (1) ("CRD VI") has now been implemented in Swedish law. Among other things, this introduces a new authorisation requirement and a branch establishment requirement for undertakings from countries outside the EEA that wish to provide certain core banking services in Sweden. For affected entities, the new rules may mean that cross-border business models need to be reviewed well in advance of the rules taking effect. The legislative amendments enter into force mainly on 1 July 2026, while the rules on the specific authorisation requirement and supervision of third-country branches enter into force on 11 January 2027. For affected entities, the new rules may mean that cross-border business models need to be reviewed well in advance of that date.

Main changes concerning the ability to carry on banking-related services in Sweden

CRD VI was adopted at EU level in 2024 and constitutes an amending directive to the Capital Requirements Directive (2). Through CRD VI, the EU introduces, for the first time, a harmonised framework for the authorisation and supervision of third-country branches and for the conditions under which credit institutions from third countries may provide core banking services in a Member State. Until now, these matters have been regulated at national level, meaning that the requirements have varied between Member States. CRD VI is framed as a minimum harmonisation directive. This means that Member States must comply with the common EU standard, but may in certain respects retain or introduce stricter national rules where the directive permits this.

Even before the legislative amendments now being introduced as part of the implementation of CRD VI, credit institutions established outside the EEA that wished to carry on banking business or financing business in Sweden were required to establish a subsidiary or branch and apply for authorisation from the Swedish Financial Supervisory Authority (Sw. Finansinspektionen, the "Swedish FSA") under the Banking and Financing Business Act (Sw. lagen (2004:297) om bank- och finansieringsrörelse). By contrast, there has been no requirement to establish a branch or obtain authorisation where only certain individual banking services were provided by foreign credit institutions or, in the case of deposit-taking, by other institutions. The new regime therefore changes the scope of the authorisation requirement, which may mean that activities previously carried on cross-border without Swedish authorisation must now be reassessed.

The new regime concerning the authorisation requirement for third-country branches is introduced in the Special Supervision of Credit Institutions and Investment Firms Act (Sw. lagen (2014:968) om särskild tillsyn över kreditinstitut och värdepappersbolag). It entails both changes to the scope of activities requiring authorisation and additional operational requirements for affected firms. The rules will therefore affect both firms that already have a branch in Sweden and firms that carry on activities falling within the new authorisation requirement but which currently have neither a branch in Sweden nor authorisation from the Swedish FSA.

The Swedish implementation is, in all material respects, aligned with CRD VI and  does not, as a starting point, entail any general national gold-plating beyond what follows from the EU framework. At the same time, the Swedish legislator has chosen not to make use of certain exemption options permitted by the directive.

Credit institutions established outside the EEA, and other undertakings engaged in deposit-taking, should review their activities in Sweden in good time. The new regime may mean that activities previously carried on without Swedish authorisation will instead become subject to branch establishment and authorisation requirements imposed by the Swedish FSA. It will therefore be essential for affected firms to analyse which services are being provided in Sweden, how the activities are conducted, and whether organisational, operational or regulatory adjustments are required before the new rules begin to apply.

The following sets out in more detail the substance of the new requirements and how they have been implemented in Swedish law.

Authorisation requirement for third-country undertakings providing core banking services in Sweden

The new authorisation requirement means that certain undertakings established outside the EEA must obtain authorisation from the Swedish FSA and establish a branch in order to provide core banking services in Sweden. The requirement applies to third-country undertakings and in this respect reflects the requirements laid down in CRD VI. Such services may therefore, as a starting point, not be provided in Sweden without authorisation.

The requirement to obtain authorisation and establish a branch applies to undertakings established in a third country that intend to provide:

1. any of the services referred to in points 2 and 6 of Annex I to the Capital Requirements Directive, namely lending and the issuing of guarantees and commitments, provided that the undertaking, had it been established within the EEA, would have been classified as a credit institution under the Banking and Financing Business Act or as an investment firm of the kind referred to in Article 4(1), point 1(b) of the Capital Requirements Regulation, or
2. activities in Sweden involving the taking of repayable funds from the public.

In this context, core banking services include in particular:

• taking deposits and other repayable funds;
• lending including, inter alia: consumer credit, credit agreements relating to immovable property, factoring, with or without recourse, financing of commercial transactions (including forfeiting);
• guarantees and commitments.

Exemptions from the authorisation requirement

There are certain exemptions from the authorisation requirement. These exemptions reflect the exemptions provided for in CRD VI and are to be applied restrictively.

Exemptions from the authorisation requirement, and thus from the branch establishment requirement, apply in the following situations:

• Reverse solicitation: where the client approaches the third-country undertaking exclusively on the client’s own initiative. The exemption does not apply where the third-country undertaking, or a person acting on its behalf or having close links with it, has initiated the contact. The exemption covers only the service requested by the client and services and products closely related to that service, and therefore does not extend to the offering of other services or products.
• Interbank exemption: where the third-country undertaking provides the services to certain categories of credit institutions, that is, banks or credit market companies under Swedish law, or large investment firms as defined in Article 4(1), point 1(b) of the Capital Requirements Regulation, or equivalent foreign undertakings.
• Group exemption: services provided by the third-country undertaking to undertakings within the same group.
• Services provided in connection with certain investment services and ancillary services: where the third-country undertaking provides the core banking services in connection with the investment services and activities listed in in Section A of Annex 1 to MiFID II and any related ancillary services listed in Section B of Annex 1 to MiFID II (3).

In addition, the authorisation requirement does not apply to agreements entered into before 11 July 2026 under the applicable transitional provisions, as discussed further in the section on timeline below.

Conditions for authorisation

The conditions for authorisation are broadly consistent with CRD VI, although with certain adjustments. In order to obtain authorisation, a third-country branch must satisfy a number of statutory requirements. These include, adequate capital and liquidity, effective risk management, documentation and internal control, and the requirement that the third-country undertaking holds authorisation in its home country for the activities covered by the application. Authorisation also presupposes that the undertaking is subject to adequate supervision in its home country, that the home state supervisory authority has been informed of the establishment in Sweden, and that the Swedish FSA considers that it will be able to exercise effective supervision over the branch.

Authorisation must not be granted where there are grounds to assume that the activities are connected with, or may increase the risk of, money laundering or terrorist financing. For certain third-country branches, it is also required that deposits are covered by the Swedish deposit guarantee scheme or by a foreign guarantee scheme that corresponds, to the Swedish scheme in relevant respects.

Further information on the information to be submitted to the Swedish FSA in connection with an application will be specified in the Swedish FSA’s regulations. On 20 March 2026, the Swedish FSA published draft regulations on the implementation of CRD VI, including regulations setting out the requirements applicable to authorisation applications.

Regulatory requirements for authorised third-country branches

CRD VI lays down minimum requirements with which a third-country branch must comply. This means that the activities of foreign branches in Sweden will be subject to operational and prudential requirements, including in relation to capital and liquidity, risk management, documentation, and internal governance and control. For branches that obtain authorisation, this means more detailed requirements than previously. Capital and liquidity requirements vary depending on the classification of the branch and broadly correspond to the regime under CRD VI, although the Swedish legislator has chosen not to make use of certain options available under the directive, for example the option to exempt qualifying third-country branches from the liquidity requirement.

The rules also include requirements relating to the branch’s organisation and internal control environment. These include requirements concerning risk management, internal governance and control systems, reporting lines, the handling of ICT matters, oversight of outsourcing arrangements, and the management of counterparty credit risk and intra-group arrangements. In addition, the branch must have at least two managing directors resident in Sweden with sufficient knowledge, experience and suitability for the role, and who devote sufficient time to it. There are also requirements concerning documentation and bookkeeping arrangements.

In this area too, the Swedish FSA has published proposed regulations and general guidelines specifying certain of these requirements in greater detail.

Supervision and intervention powers

The Swedish FSA will supervise third-country branches and verify that their activities are conducted in accordance with the Special Supervision of Credit Institutions and Investment Firms Act (Sw. lagen (2014:968) om särskild tillsyn över kreditinstitut och värdepappersbolag), other applicable rules, and internal instructions based on such rules. CRD VI also introduces enhanced information and reporting requirements, meaning that third-country branches must provide the information that the Swedish FSA requires for supervisory purposes and must regularly report information on the branch’s activities and on the third-country undertaking. In addition, the Swedish FSA will have expanded intervention powers, including the power to order a branch to limit its activities, reduce risks, or take other remedial measures, and, in the case of systemic branches, in certain circumstances require the activities instead to be carried on through a subsidiary holding the necessary authorisation. CRD VI also contains rules on the withdrawal of authorisation, and although the Swedish regime has in some respects been given a different legislative-technical form, the intention is that the Swedish FSA should be able to withdraw authorisation on the grounds laid down in CRD VI.

Timeline and entry into force

The legislative amendments enter into force on 1 July 2026, except for the rules on the specific authorisation requirement and specific supervision of third-country branches, which enter into force on 11 January 2027. However, the new provisions on the authorisation requirement will apply to applications submitted to the Swedish FSA from 1 July 2026, provided that the application relates to a period from 11 January 2027 onwards.

The authorisation requirement covers agreements entered into after 10 July 2026 that concern new obligations. Agreements entered into before 11 July 2026 are, as a starting point, outside the scope of the new regime. This means that existing contractual relationships may in principle continue and be performed in accordance with their existing terms. If, however, an existing contractual relationship is subsequently amended, extended or otherwise supplemented in a way that gives rise to new obligations, it will be necessary to assess specifically whether the authorisation requirement is thereby triggered.

1. ^

    Directive (EU) 2024/1619 of the European Parliament and of the Council of 31 May 2024 amending Directive 2013/36/EU as regards supervisory powers, sanctions, third-country branches, and environmental, social and governance risks

2. ^

    Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC

3. ^

    Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU, as amended by Directive (EU) 2024/790