What Is PRIIPs? The Issuer's Guide to EU Retail Distribution

PRIIPs (Packaged Retail and Insurance-based Investment Products) is an EU regulation, formally known as Regulation (EU) No 1286/2014, and applied since 01/01/2018. PRIIPs requires anyone who manufactures, advises on, or sells a packaged investment product to a retail investor in the EU to publish a standardised Key Information Document (KID) before the transaction.

In simple words: if a company creates, recommends, or sells a complicated investment product to an everyday person (not a professional investor) anywhere in the EU, that company has to hand the person a short, standard information sheet before they buy it.

The KID is a stand-alone disclosure of up to 3 pages, designed to make investment products comparable across product types and across the 27 EU markets. For an issuer, the regulation looks like a disclosure burden but in practice it functions as the only document that legally allows retail distribution across the EU on a single dataset. An example of a PRIIP is a structured deposit, where you put money into what looks like a savings account, but instead of a fixed interest rate, your return depends on how a stock market index performs.
Another example specifically for asset managers, could be an Alternative Investment Fund (AIF) - such as a private equity, real estate, or hedge-fund-style vehicle - offered to retail investors, since these fall under PRIIPs once they're distributed outside of purely institutional channels.

Does PRIIPs apply to you? A quick self-check:

• Does your product have variable returns or an SPV structure, rather than a fixed-rate return?

• Are you selling, advising on, or manufacturing it for EU retail investors?

• Are you relying on the small-offer prospectus exemption instead of a full prospectus?

If you answered yes to any of these, the rest of this guide applies to you directly.

Who does PRIIPs apply to, and which products are in scope?

PRIIPs applies to any person who manufactures a packaged investment product; for example, a bank creating a structured note, an insurer designing a unit-linked life insurance policy, an asset manager launching an investment fund or anyone who advises on or sells a PRIIP to a retail investor. According to EIOPA, a retail investor is a retail client under MiFID II or a customer under the Insurance Distribution Directive who does not qualify as a MiFID professional client. This means Asset Managers and Private market Operators need to check the classification of every investor before deciding whether a PRIIPs KID is required - the obligation only kicks in when the buyer counts as "retail," not when they're a professional client. This covers fund managers, life insurers, structured-product issuers, financial advisers, distributors, and operators of retail investment platforms.

PRIIPs is sometimes confused with MiFID II. The two regulations sit alongside each other and apply to different parts of the transaction. MiFID II regulates the investment firm and the conduct of the service, including authorisation, suitability, and reporting. PRIIPs regulates the product disclosure given to the retail investor before that investor commits. Both can apply to the same issuance: MiFID II shapes how it is sold, PRIIPs shapes what the investor sees.

In-scope products include regulated collective investment schemes, alternative investment funds (including EuVECAs and EuSEFs), structured investment products, structured deposits as defined in MiFID II, derivatives, insurance-based investment products such as unit-linked policies, and securities issued by certain special purpose vehicles with variable returns.
Out of scope are direct equities, fixed-rate debt securities, pension products, non-life insurance, life insurance contracts that pay out only on death or incapacity, and ordinary deposits that are not structured deposits. National tax-advantaged wrappers, such as the French PEA, are not PRIIPs in themselves, although the funds and structured products held inside one usually are.

Note on UK jurisdictions. The United Kingdom repealed PRIIPs in April 2026 and replaced it with the Consumer Composite Investments (CCI) Regulations; issuers with UK exposure should confirm the current FCA transition timeline, as some UK PRIIPs-format disclosures may remain usable during a transitional period. This article addresses the EU regime, which remains in force across the 27 member states.

What goes into a PRIIPs KID, and how is it different from a prospectus?

A PRIIPs KID is written in the customer's language, and is provided in good time before the retail investor is bound by any contract. The structure is fixed: every KID covers the same seven sections in the same order. There is no national variation in layout, and no pre-approval by a competent authority is required to publish one.

The 7 sections, set by the Commission Delegated Regulation (EU) 2017/653, are:

1. What is this product

2. What are the risks and what could I get in return

3. What happens if the manufacturer is unable to pay out

4. What are the costs

5. How long should I hold it and can I take money out early

6. How can I complain

7. Other relevant information

The risk section uses a Summary Risk Indicator (SRI) on a 1 to 7 scale. The costs section uses a standardised "reduction in yield" methodology.

Below is an example of how a KID could be structured like in practice;

A KID is not a substitute for a prospectus under Regulation (EU) 2017/1129. A prospectus is hundreds of pages, requires approval by a national competent authority, and is intended for offers that exceed the small-offer thresholds set by member states. A KID is short, standardised, and is the principal retail disclosure when an issuer relies on the small-offer exemption. The two documents serve different purposes: a prospectus authorises the offer, a KID informs the retail investor.

What is the European PRIIPs Template (EPT), and why is it the operational cost of PRIIPs?

In summary so far:

PRIIPs (the law) sets the requirement - manufacturers must produce a KID with specific data points: risk indicator, performance scenarios, costs, etc.

The KID (the output) is the actual document a retail investor sees - a short, standardized, human-readable sheet.

Now What is the European PRIIPs Template?

The EPT (the data format) is what makes the KID possible at scale. Rather than every manufacturer calculating and formatting these data points differently, FinDatEx created a common structured template so that:

• Manufacturers calculate the required PRIIPs figures (risk scores, cost breakdowns, performance scenarios) once, and populate the EPT with them in a standardized, machine-readable way.

• Distributors (banks, platforms, advisors selling the product) pull data from the EPT to automatically generate the KID document, or to feed their own systems, instead of manually re-entering numbers from PDFs.

• Data vendors and calculation agents (e.g., companies that compute the risk/cost figures for many manufacturers) use the EPT as the common language to pass that data on to distributors industry-wide.

The European PRIIPs Template (EPT) is a structured, machine-readable data format maintained by FinDatEx, the European cross-industry working group for financial data exchange standards. FinDatEx includes asset-management, banking, and insurance trade bodies, and its templates are the de facto market standard for the data points used in PRIIPs KIDs.

Why is it the operational cost of PRIIPs?

The EPT standardises the inputs that go into the KID. Each EPT record covers the Summary Risk Indicator, costs and charges, performance scenarios, the recommended holding period, and target market alignment. The current production version is EPT v2.1, published in September 2022 with an editorial update in October 2022. The EPT is free to use and is not legally mandatory, but every distributor and data vendor in the EU has built its retail-disclosure plumbing around it.

This is the section of PRIIPs that almost no public explainer covers, and it is where the regulation gets expensive. A KID is a document that is produced once. An EPT is a dataset that is produced, validated against the FinDatEx schema, versioned every time FinDatEx publishes an update, distributed to multiple recipients on a recurring schedule via email, SFTP, or API, and reconciled when a distributor flags a field that does not match its records. For a traditional asset manager with a network of distributors, the EPT is a continuous data pipeline. The KID is the visible artefact of PRIIPs. The EPT is the operational cost.

Client: "So that means these are pieces of information that the SPV gives the investor in relation to a deal. And the PRIIPs KID aren't signed either, right?"
ONINO: "Exactly, they're basically just for display. It's like a share, in the end. I don't sign every digital share individually. The master document is then the subscription form, where it says I've seen this and accepted it."

How does the EU Listing Act's €12 million exemption change PRIIPs in practice?

From 5 June 2026, the EU Listing Act (Regulation 2024/2809) raised the small-offer prospectus exemption from €8 million to €12 million per issuer, calculated on a rolling 12-month basis. The exemption does not change PRIIPs itself. The exemption changes the band of issuances where a PRIIPs KID is the principal retail disclosure instead of a full prospectus.

The mechanics matter. The threshold now applies per issuer rather than per issue, so multiple offers from the same issuer must be aggregated across the 12-month window. Member states may set a lower national threshold but cannot go below €5 million. Above the national threshold, a full prospectus is required. Below it, the issuer can offer to the public without filing a prospectus, and the PRIIPs KID is the document the retail investor receives.

The practical consequence is significant. A small or mid-cap issuer can now offer up to €12 million per year of a PRIIPs-eligible instrument to retail investors without filing a prospectus, on the basis of a three-page KID and the EPT data behind it. The same exemption applied at €8 million for years. The €12 million ceiling brings a meaningfully larger set of issuances into the PRIIPs-only retail-access route. For ONINO and similar regulated financing infrastructure, this is one of the most consequential regulatory changes of 2026 for direct-to-retail issuance. What the exemption does not carry is an EU passport. It applies country by country, so an issuer offering into several member states works within each national threshold, which can be as low as €5 million, and meets whatever national disclosure that member state attaches to the exemption. Germany, for example, requires a securities information sheet (Wertpapier-Informationsblatt, WIB) permitted by BaFin under §4 WpPG alongside the PRIIPs KID. The KID format is the same in all 27 markets; the exemption that lets an issuer rely on it is not. The ECSPR (European Crowdfunding Service Provider Regulation) remains an alternative retail-access route, but operates with its own constraints and licence requirements.

Are tokenized securities covered by PRIIPs?

Yes, when the tokenized instrument fits the PRIIP definition. EIOPA explicitly names "instruments issued by special purpose vehicles" in its list of in-scope products, alongside "debt securities where the amount repayable is subject to fluctuations because of exposure to reference values." These are precisely the legal wrappers most tokenized issuances use.

Tokenization is a technology layer, not a regulatory escape. A token that represents an SPV-issued variable-return instrument is a PRIIP. A token that represents a fixed-rate corporate bond, where the amount repayable is not subject to fluctuations, is not. The legal character of the underlying instrument determines PRIIPs scope. The fact that the instrument is held and transferred on a distributed ledger does not. EIOPA's guidance on in-scope products predates widespread tokenization and does not name blockchain-based instruments specifically, so issuers should confirm the classification of a given token with counsel rather than treat it as settled.

In ONINO customer engagements, the PRIIPs route is consistently the default regulatory framing for tokenized retail issuances that sit under the small-offer prospectus exemption. The issuer relies on the exemption to avoid a full prospectus, prepares a KID for retail investors, and produces the EPT data alongside the KID. The combination is short, standardised, and applies across all EU markets without a separate per-country filing. For practitioners building a security token offering in the EU, PRIIPs is not the regulation to escape; PRIIPs is the regulation that makes the offering possible.

How does direct-to-retail issuance change the PRIIPs operational stack?

The operational cost of PRIIPs sits in what we call The PRIIPs Distribution Stack: four layers that an issuer running PRIIPs must operate end to end. The four layers are the KID document, the EPT dataset, the distribution channels, and the feedback and query loop. Traditional fund managers run all four layers because the asset manager and the distributor are different firms, and the EPT must move between them on FinDatEx.

For a direct-to-retail issuer that operates its own platform, three of those four layers collapse into one canonical record. The issuer is the distributor. The EPT becomes an internal artefact, not a continuously-distributed feed. The query loop is internal. The KID remains mandatory, and the EPT remains the market standard the distribution chain runs on, but the distribution overhead largely disappears.

This is why PRIIPs reads as a compliance tax to fund managers and as a passport to direct-issuance platforms. The legal obligations are identical. The operational expression is not. Direct-to-retail issuance platforms collapse the EPT distribution chain by design, because issuer and distributor are the same entity - an approach covered in more depth in ONINO's overview of regulatory compliance in tokenization. The cost moves from the distribution layer to the document layer, which is a single, short, standardised three-page disclosure produced once per instrument.

For an issuer evaluating whether to build this stack internally or use existing infrastructure, the question is not whether PRIIPs is operationally cheap or expensive. The question is which layers of the Distribution Stack the issuer wants to own. The KID is mandatory regardless. The EPT is not law, but it is market-mandatory in practice for any issuer distributing through third parties. The multi-distributor channel and the query loop are not mandatory if the issuer keeps distribution direct. Regulatory compliance in tokenization is increasingly about choosing which compliance layers to operationalise inside the platform, and which to absorb as ongoing operational cost.

PRIIPs is sold to issuers as a disclosure burden, but the regulation is more useful than that framing suggests. A PRIIPs KID is a single, standardised document that gives a retail investor in any EU market the same information about an investment product, in the same order, in their own language. For an issuer, the KID is the legal mechanism that opens 27 retail markets on one disclosure. Combined with the small-offer prospectus exemption raised to €12 million, the regulation is now the cheapest legal route into EU retail capital for any issuance that fits inside the threshold. The catch is the EPT: issuers that distribute through third parties pay for the ongoing dataset as well as the document, while issuers that run their own retail-facing platform pay for the document and keep the dataset in-house. The regulation does not distinguish between the two. The operational cost does.

Frequently asked questions

When did PRIIPs start to apply?

PRIIPs has applied since 1 January 2018 and is in force in all 27 EU member states. The United Kingdom repealed it in April 2026 and replaced it with the Consumer Composite Investments (CCI) Regulations.

What is the difference between a KID and a prospectus?

A KID is a short, standardised three-page document for retail investors and needs no approval from a competent authority. A prospectus runs to hundreds of pages, must be approved by a national competent authority, and is required for offers above the small-offer thresholds.

Does every tokenized security fall under PRIIPs?

No. What decides it is the legal character of the underlying instrument. A token representing an SPV-issued instrument with variable returns is a PRIIP; a token representing a fixed-rate bond generally is not.

Is the EPT legally required?

No. The EPT is free to use and is not law. It has become the de facto market standard that almost every distributor and data vendor in the EU builds its systems around.

Summary

• PRIIPs (Regulation (EU) No 1286/2014) has required a standardised three-page KID for packaged investment products sold to EU retail investors since 1 January 2018.

• The KID follows seven fixed sections and does not replace a prospectus; it is the principal retail disclosure when an issuer relies on the small-offer exemption.

• The real operational cost is the EPT, a FinDatEx-maintained dataset that is validated, versioned, and distributed on a recurring schedule.

• The EU Listing Act raised the small-offer exemption to €12 million per issuer from 5 June 2026, widening the PRIIPs-only retail-access route. That exemption is national rather than passported, and some member states require their own disclosure document alongside the KID.

• Tokenized securities fall under PRIIPs when the underlying instrument fits the definition; direct-to-retail issuance materially reduces the EPT distribution overhead.

If you are building a regulated retail-issuance product in the EU, the next read is ONINO's guide to regulated infrastructure for tokenized securities, which covers the layers that sit underneath a PRIIPs offering.

Last reviewed by Lukas Wipf CPO & Co-Founder at ONINO, 26 June 2026.