What Is a Liability Umbrella? Haftungsdach and Regulatory Hosting Explained

Selling investments to other people is a licensed activity almost everywhere in Europe, and getting that licence takes about a year and at least €75,000 of capital before you place a single euro. A liability umbrella, in German a Haftungsdach, is the way around it: a firm that already holds the licence lets you work under it, keeps the regulatory responsibility, and leaves you the clients. That is the arrangement behind many European white-label investment platforms. So yes, you can sell investments under another firm's permission. You register with the regulator as a contractually bound agent of a licensed host, you can start in weeks rather than a year, and in Germany you may not hold client money or securities while you do it. The rest of this post covers what that costs, how the two routes compare, and where the model stops once your product is a token, for Germany and the EEA under MiFID II, current as of August 2026.

As shown in the graphic, the host holds the licence, supervises the work and carries the regulatory liability, while your firm owns the client relationships, places the deals and earns the upside. Commercial work and regulated risk sit apart.

A liability umbrella is a borrowed licence, not insurance

A liability umbrella is a licence you borrow, not an insurance policy you buy. One firm holds permission from the financial regulator to advise on or place investments, and it agrees to take responsibility for a smaller firm doing that work under its permission. The smaller firm keeps the deals and the client relationships, and the licensed firm keeps the supervision and the liability. It is called a Haftungsdach in Germany and regulatory hosting from the host firm's side, and the UK's separate appointed representative regime works on the same principle. Insurance does the opposite job: it moves financial risk to an insurer after something has gone wrong, while a liability umbrella moves regulatory responsibility to a licensed firm before you sell anything at all.

Who uses a liability umbrella?

The firms that borrow a permission tend to need only a small piece of one. Typical users are placement agents, operators of the digital investment platforms wealth managers use, and real estate or renewable energy issuers with their own distribution arm, each needing permission for one or two activities rather than the full set an investment firm holds. Those two activities are usually placement, meaning putting a specific investment in front of investors and taking their orders, and advice, meaning recommending it to a particular investor.

How regulatory hosting works

Regulatory hosting is the licensed firm's side of a liability umbrella. The host, called the principal, does four things for the firm underneath it: due diligence before onboarding, registration with the regulator, ongoing supervision of how the agent deals with clients, and the regulatory reporting that follows. Under Article 29 of MiFID II, the rulebook covering investment services across the EU, every tied agent has to appear in the public register of the country where it is based, and the host stays fully and unconditionally responsible for the regulated work that agent does.

How does onboarding with a liability umbrella work?

Onboarding runs in a fixed order: due diligence on your company and its people, the tied agent contract, registration of the firm, the qualification evidence for whoever will deal with investors, and then supervision starts. That is weeks rather than months once your documents are ready, and a few months when they are not. The qualification evidence attaches to the individual people who advise investors or take their orders rather than to the firm, so check early whether the colleagues you already have will clear it, because hiring for that is what turns a weeks-long onboarding into a months-long one.

Who owns the investor relationship, you or the host?

The agent owns the investor relationship and the host sees it. The offering documents stay the issuer's own, but onboarding files, suitability records and transaction reports all pass to the host, because it is liable for them. You cannot contract the host out of seeing that data, only out of using it, and the clause that does that is non-solicitation: it is normal in these contracts rather than something you have to invent, its length is negotiable, and its absence is the red flag. Because the German rule also bars you from holding client money, investor funds run through the host, a licensed payment institution or an escrow account rather than your own account.

Haftungsdach: the German liability umbrella (KWG and WpIG)

A Haftungsdach is the German name for a liability umbrella: a securities institution that lets contractually bound agents (vertraglich gebundene Vermittler) work under its BaFin permission and carries the regulatory liability for them. BaFin, the German financial regulator, keeps one public register of those agents, and German law defines them twice, in section 2(10) of the Banking Act (KWG) for agents working under a bank and in section 3(2) of the Securities Institutions Act (WpIG) for agents working under a securities institution. Hosting today sits mostly with securities institutions, so a German Haftungsdach is in practice a securities institution holding a placement or advice permission that it extends to the agents underneath it.

Passporting: does a German umbrella work across the EU?

Yes. A German liability umbrella reaches across the EEA, because the MiFID II permission underneath it is European and can be passported: the host notifies its home regulator, and the same permission then covers other EEA countries without a second authorisation. The passport travels with the MiFID permission, so it carries securities and tokenised securities but not nationally defined products such as Vermögensanlagen, which a German Haftungsdach still covers at home but cannot carry abroad. Outside the EEA it stops altogether: marketing to Swiss investors runs under Swiss law and needs its own arrangement.

What does a liability umbrella cost?

A liability umbrella costs a one-time onboarding fee plus an ongoing charge on the business you write. German hosts charge onboarding fees of €10,000 to €15,000, covering due diligence and registration. The ongoing side is where hosts actually earn: a monthly supervision fee, a share of the placed volume or of the commission the agent earns on it, or a combination, and structures vary between hosts far more than the headline onboarding fee does. Pin down which of those two bases a quote uses, because on a typical placement commission the two can differ by more than an order of magnitude, and then price it on your own projected volume: every 1% of placed volume on a €5M raise is €50,000, several times the one-time fee, which is why the ongoing charge decides this and the onboarding fee does not. Add the internal hours your team will spend answering compliance requests, and if the total over two years approaches what a compliance hire plus a licence application would cost you, the own-licence route is worth re-running.

Liability umbrella vs your own licence: which costs less?

Your own licence costs capital before it costs anything else. A firm that only passes on orders and gives investment advice, and may not hold client money or securities, needs €75,000 of initial capital under Article 9 of the EU Investment Firms Directive, and from then on has to hold own funds of at least a quarter of its annual fixed costs under the Investment Firms Regulation, which for a firm with staff is usually the bigger number. On top of that sit the costs the figures hide: the regulator's application fees, the legal drafting, the audited accounts, and the named, qualified staff who have to be hired before approval rather than after it. Time is the last and largest of them, because Article 7(3) of MiFID II gives the national regulator six months to decide on a complete application, preparation usually takes at least as long again, and every month of that year is salaries and advisers paid before the first regulated transaction.

Germany, 2026. A liability umbrella compared with your own investment firm licence, for placing and advising on investments.

When is a liability umbrella the right route?

A liability umbrella is the right route when three tests pass: scope, cost and control. The scope test comes first: every activity you need has to sit inside the host's own authorisation, because a host cannot lend a permission it does not hold. The cost test comes second: your projected volumes over the next two years have to make the onboarding fee and the ongoing charges cheaper than the full cost of your own licence. The control test comes third, and it is the one firms underweight, because your permission to sell lives inside a contract with another company and that contract can be terminated. Ask early whether the host approves each offering or only the relationship, because product governance rules under Article 16(3) of MiFID II make the host answerable for what its agents distribute, so each offering needs the host's approval before you can market it.

The trade that works at launch stops working at scale. Volumes grow, a charge tied to placed volume grows with them while the cost of a licence stays fixed, and a dependency that was sensible at launch starts to look like a single point of failure.

Can you leave a liability umbrella later?

Yes, and it is a change of permission rather than a rebuild: the platform, the investor records and the offering stay where they are, and only the party holding the permission changes. A new host runs its own due diligence and re-papers the agreements, so budget for that, and negotiate the terms before you need them: a notice period long enough to finish a raise already in flight, and what happens to an open offering if the host leaves the business.

Does a liability umbrella cover tokenised securities?

A liability umbrella covers a tokenised security exactly as it covers any other one, provided the activity sits inside the host's MiFID II permissions. The instrument itself is issued under whichever securities framework applies to it, in Germany the Electronic Securities Act (eWpG), so one offering runs on two separate rulebooks: one for what the instrument is, and one for how it is sold, which is one line on the longer checklist for EU issuers. They have to be arranged together, because issuers who solve only the first half find out about the second half at the moment they try to sell.

Does a liability umbrella cover MiCAR crypto-asset services?

No, and one classification decides it. The tied agent mechanism belongs to MiFID II and applies to investment services in financial instruments, and MiCAR, the EU's crypto-asset regulation, does not carry that mechanism over to crypto-asset service providers. A liability umbrella is therefore the right tool when the token is a security and no substitute for a MiCAR authorisation when the asset is an in-scope crypto-asset, where the equivalent answer is a licensed crypto-asset service provider rather than a tied agent relationship.

Issuance or distribution: which one needs a licence?

Distribution needs a licence and issuance generally does not. Issuing your own instrument is not in itself a licensed activity, while distributing it, placing it or advising on it is, and only the second half is what a liability umbrella hosts on your behalf, whether the offering is listed to a broad investor base or placed privately. That same division between the issuer and whoever distributes is what sits underneath a two-tier marketplace model, and it holds whichever format the instrument takes, whether a Vermögensanlage, a classic security or a tokenised bond, so an issuer can bring one to market without holding an investment services licence of its own.

Does your liability umbrella need to be integrated with your platform?

Yes, because the host is liable for the business you write and has to see it happening. Subscription flows, investor onboarding, KYC checks and transaction reporting all have to pass from the operator's platform into the host's supervision, and an operator who builds their own platform builds and maintains that integration too, so every change on the host's side becomes a change on theirs.

Integration is therefore the strongest argument for running on white-label infrastructure that already has a liability umbrella connected: the umbrella already knows the technology it is supervising, and the operator has nothing to build and nothing to maintain. The liability umbrella is one of ONINO's pre-integrated licensed partners, which is why the build or buy decision and the licensing decision are best taken together: the integration exists already, while the tied agent contract is still yours to sign. Because the regulated relationship exists before the operator arrives, launching a white-label platform runs to weeks or a few months rather than the year an own licence takes.

So should you borrow a licence or get your own?

Ultimately, a liability umbrella is the right answer at launch and the wrong answer at scale, because it buys the two things a new offering is short of, time and capital, at the price of depending on another firm's permission. Of the three tests, the scope test decides the most: a fee you dislike can be renegotiated and a dependency you dislike can be exited, but a permission the host does not hold cannot be created at any price. Classify the instrument first, list the exact activities you need permission for second, and only then ask a host what they charge.

Map the permissions before you price the host

ONINO is white-label financing infrastructure: clients run their own branded platform on it, and the licensed functions an offering needs are already connected through pre-integrated partners, from the liability umbrella to the registrar, the custodian and the payment institution. As of 2026, client platforms running on ONINO operate in seven or more jurisdictions and carry more than €50M in tokenised volume.

Running the scope and cost tests against your own instrument comes next: which format it belongs in, which activities trigger a permission, and which of those sit with a partner rather than with you. Vendors differ on exactly that point, which is why the guide to the top white-label platforms in Europe compares their partner stacks side by side.

Written by Kristina Stark, Growth Manager at ONINO, and reviewed by Lukas Wipf, CPO and Co-Founder. General information, not legal advice.