🏔️ Monaco, Andorra, San Marino, Liechtenstein, and the Crown Dependencies

Three legal statuses that are easy to confuse

The nine European jurisdictions in this guide fall under three regimes of applicable law. The first is the European Economic Area, which adopts EU single-market law (the acquis) one act at a time. The second covers the states bound to the EU by a monetary agreement, whose annex lists the EU acts they adopt. The third covers jurisdictions under the British Crown, which legislate for themselves on financial matters. Practitioners meet all nine in the same form: a billing address that looks European, whether in Monaco, Vaduz, St. Helier, or Gibraltar. Prices are often shown in euros. IBANs travel on the same rails, and cards carry the same brands. The regime a jurisdiction falls under determines which rights the customer has and which obligations bind the provider. Confusing two of these regimes means promising a customer a right they do not have, or taking on an obligation that does not apply.

Liechtenstein is a member of the European Economic Area and of the European Free Trade Association (EFTA). It adopts EU single-market law act by act, through decisions of the EEA Joint Committee. Directive (EU) 2015/2366 was transposed by the Zahlungsdienstegesetz, which took effect on October 1, 2019. The Finanzmarktaufsicht (FMA) licenses payment institutions on that basis. Legal tender in Liechtenstein is still the Swiss franc, under the monetary treaty that ties the principality to Switzerland. A Liechtenstein payment institution is therefore governed by EU payment services law, in a country whose currency is not the euro.

Monaco, Andorra, San Marino, and Vatican City belong to a second group: states with a monetary agreement with the EU. The euro is their official currency, and all four mint coins with their own national side. None is a member of the EU or the European Economic Area. Each agreement has an annex listing the EU legal acts the state undertakes to implement. The areas covered vary from one agreement to the next. They range from banknotes and coins to banking and financial law, anti-money laundering, fraud and counterfeiting prevention, and sometimes statistical reporting. The European Commission updates the annex at least once a year, and a joint committee oversees how the agreement is implemented.

The Crown Dependencies make up the third group: territories that legislate for themselves. Jersey, Guernsey, and the Isle of Man are part of neither the UK nor the EU. They are dependencies of the British Crown. Each has its own legislature and sets its own tax and financial laws. Their only link to the European Community was Protocol No 3 to the UK’s 1972 Act of Accession. The protocol brought them into the customs union for goods but did not extend the freedom to provide services to them. It ceased to apply when the UK left the EU. No EU acquis applies there today.

Gibraltar ended up in the same group by a different route: leaving the EU. A British Overseas Territory, it was part of the EU until January 31, 2020, under Article 355(3) of the Treaty on the Functioning of the European Union. That provision covers European territories whose external relations are handled by a member state. Even then, three whole areas of EU law did not apply: Gibraltar was outside the customs union, the common VAT area, and the Common Agricultural Policy. Its providers lost the EU passport at the same time as UK providers. Their local law is still largely modeled on the directives they applied before Brexit.

What applies anyway: SEPA reachability, IBANs, and cross-border fees

SEPA reachability is the ability of an account to receive a credit transfer or a direct debit made under the European Payments Council (EPC) schemes. It rests on a contractual commitment, which is why it can extend to territories outside the EU. The credit transfer and direct debit schemes the EPC publishes are scheme rulebooks that a provider joins voluntarily, committing to follow their rules. The EPC publishes the geographic scope within which providers can join under reference EPC409-09. The document is titled EPC list of Countries in the SEPA Schemes’ Geographical Scope, and it is updated as the EPC board makes decisions. Whether a country or territory is reachable is determined solely by the version of that list in force on the relevant date.

Jersey, Guernsey, and the Isle of Man joined that scope on May 1, 2016, after each had adopted the legislation the EPC required. The EPC attached a restrictive eligibility criterion to their admission: only locally incorporated firms authorized to take deposits may join. The laws the EPC cites are the Banking Business (Jersey) Law 1991, the banking supervision law of the Bailiwick of Guernsey, and the Isle of Man Financial Services Act 2008. An island payment institution does not meet that criterion, even if its local regulator has licensed it. It can reach the schemes only through a participating bank.

The three Crown Dependencies have no entry of their own in the IBAN registry. The codes JE, GG, and IM do exist in ISO 3166, which created them in 2006. But the IBAN registry files accounts on all three islands under the United Kingdom entry. An account held in St. Helier or Douglas therefore has an IBAN starting with GB, built on a UK sort code. Any routing, pricing, or compliance rule that infers the account’s country from the first two letters of the IBAN classifies these accounts as UK accounts. It then points to the wrong regulator, the wrong governing law, and the wrong tax regime, since each island has its own authorities. The jurisdiction of an island account is determined by the institution that holds it, not by its IBAN prefix.

In the four states with a monetary agreement, the euro’s legal tender status comes from the agreement itself, not from a unilateral decision. Each may mint euro coins with its own national side, up to an annual ceiling set by the agreement and revised by the joint committee. These coins are legal tender throughout the euro area and circulate there on the same footing as those of member states. Banknotes are issued by the Eurosystem alone, and none of the four states sits on it. They therefore have no say in the monetary policy decisions that govern the currency they adopted as their own.

Regulation (EU) 2021/1230 on cross-border payments requires a cross-border euro payment to cost the same as a domestic payment of the same amount in the national currency. It covers providers located in the EU. A Monegasque, Andorran, or San Marino institution is therefore not bound by the regulation itself, unless the annex to its monetary agreement commits it. The same gap applies to the reachability obligations in Regulation (EU) No 260/2012, whose Article 3 covers providers in member states.

What does not apply: PSD2, refunds, GDPR, and VAT

Directive (EU) 2015/2366 and Delegated Regulation (EU) 2018/389, which supplements it on strong customer authentication (SCA), apply to providers established in the European Economic Area. The European Banking Authority (EBA) spelled out the consequence in its opinion of June 13, 2018, and then in two answers in its Q&A tool published on September 6, 2019. Only the location of the providers matters. When only one of the two providers is in the EEA, the transaction is called one-leg-out. SCA cannot be required in that case; the EBA expects only best efforts from the EEA provider. A card issued in Monaco, Jersey, or Gibraltar is therefore outside the scope of mandatory SCA.

The right to a direct debit refund also depends on where the provider is established. Article 76 of PSD2 gives the payer an unconditional right to a refund of an authorized SEPA direct debit, claimed within the eight-week window set by Article 77. That statutory right covers EEA providers. A debtor whose account is held in Monaco or Guernsey does get the same eight-week window, because the SDD Core rulebook provides for it and their provider has signed up to it. The difference lies in how that commitment is enforced. No competent authority under PSD2 oversees compliance with it, and no EU out-of-court dispute resolution body can take the complaint.

Regulation (EU) 2016/679 was incorporated into the EEA Agreement in July 2018, effective July 20, 2018. Liechtenstein therefore applies it directly. For the other jurisdictions, transferring personal data out of the EU requires a legal basis under Chapter V of the regulation. An adequacy decision is one such basis, and it spares the controller from providing the appropriate safeguards required elsewhere in that chapter. The European Commission has adopted one for Andorra, Guernsey, the Isle of Man, and Jersey. All four predate the GDPR, and the review of January 15, 2024, kept them in place. Monaco, San Marino, and Gibraltar have none.

Indirect tax splits these jurisdictions along lines that match neither their constitutional status nor their currency. Monaco is treated as part of France under Directive 2006/112/EC: Article 7 treats transactions to or from the principality as French transactions. A sale to a customer in Monaco is a French domestic sale and is taxed as one. Liechtenstein shares a common VAT area with Switzerland. The Isle of Man forms a customs and VAT union with the UK and applies UK rates. Andorra, San Marino, Jersey, Guernsey, and Gibraltar are each separate tax territories, whose regimes are set out in the table below.

EU restrictive measures, including financial sanctions, fall under the Common Foreign and Security Policy. The EEA Agreement leaves that area outside its scope. EU financial sanctions therefore do not apply in Liechtenstein simply because it belongs to the EEA. The principality adopts them through its own law on enforcing international sanctions, in coordination with the Swiss measures its customs union requires it to follow. An asset freeze ordered in Brussels takes effect in Vaduz only once that national adoption has happened, and there is a lag between the two dates.

Regulators, and where to verify a license

To verify a license, find the institution in the public register kept by the authority that granted it. In these nine jurisdictions, the competent authority rarely follows from the name of the jurisdiction where the institution operates. Monaco is the least intuitive case. Three authorities oversee its financial center, only two of them Monegasque, and neither of those two supervises banks. Matching only on the name of the authority cited in an onboarding file therefore leaves the check incomplete. Where an institution operates does not tell you which register holds its license.

Banking supervision in Monaco is carried out by the French authority under a series of bilateral agreements. Article 4 of the Franco-Monegasque convention of April 14, 1945, makes French banking regulation and banking organization rules applicable in the principality. The exchange of letters of May 18, 1963, set their scope. The agreement of October 20, 2010, rewrote it and repealed the exchange of letters of November 27, 1987. The agreement of April 6 and May 10, 2001, covers harmonized supervision of credit institutions. Published by Decree No 2003-456 of May 16, 2003, it gives the French authority responsibility for licensing and supervising them. To verify a Monegasque bank, check the French register of financial agents; no Monegasque register lists these licenses.

This split of responsibilities affects how a compliance file should be read. The prudential side is French and follows EU regulation as applied in France, while the AML side stays Monegasque and has been the AMSF’s responsibility since July 2023. The same institution can therefore have a clean prudential record while the jurisdiction it operates in appears on enhanced due diligence lists. The two findings concern different things: the institution’s prudential standing on one side, and the money laundering risk attached to the territory on the other. An onboarding questionnaire that asks only about the first does not document the second.

Liechtenstein, by contrast, sits within a fully European supervisory structure. The FMA licenses payment institutions on the same criteria as BaFin or the ACPR, and its license carries a passport across the entire European Economic Area. The EFTA Surveillance Authority, not the European Commission, monitors whether Liechtenstein applies EEA law correctly. Disputes go to the EFTA Court. EBA guidelines and technical standards take effect there through that channel. This two-pillar structure preserves the institutional balance of the EEA Agreement.

Access to the Crown Dependencies’ markets rests on no mutual recognition mechanism. No license granted in St. Helier, St. Peter Port, or Douglas opens up the EU market. None gives automatic equivalence in the UK market either. An island institution that wants to serve EU customers sets up a licensed entity in a member state or works through a partner that has one. The same applies in reverse to an EU provider entering these markets, since the PSD2 passport has no effect there. A provider active in several of these financial centers therefore holds one license per center, each issued by the local authority and valid only in its own jurisdiction.

In practice: billing, checks, delivery, and recourse

At checkout, the customer picks their country from a drop-down list that the merchant controls. The ISO 3166 codes MC, AD, SM, VA, LI, JE, GG, IM, and GI all exist, but many forms leave them out. A customer who cannot find their jurisdiction picks a neighboring country to finish the order. The address then becomes French, Spanish, Italian, or British in the merchant’s system. Every downstream process inherits that value, from tax calculation to fraud screening. No later step flags the mismatch, since the system keeps only the country chosen at checkout.

• Monaco postal codes in the 980xx series, built like French codes, with 98000 for Monaco. A check that rejects a French-style postal code paired with country MC turns away valid addresses.
• Andorran postal codes take the form AD followed by three digits, such as AD500 for Andorra la Vella. The format looks nothing like Spanish or French codes.
• San Marino postal codes in the 4789x series, borrowed from the Italian system, which a purely numeric check cannot tell apart from codes in the province of Rimini.
• Liechtenstein postal codes belong to the Swiss series, with 9490 for Vaduz. A check that requires country CH for any code in that series shuts out all of Liechtenstein.
• Island postal codes with the British prefixes JE, GY, and IM, valid in the UK format but tied to countries other than the UK.
• Gibraltar uses a single postal code for the whole territory, GX11 1AA. An address check or a delivery-zone calculation based on that code gets no information from it.

Automated address verification compares the address entered at checkout with the one the issuer holds for the cardholder. The card networks’ address verification services cover only a few markets, and issuers rarely hold the reference data for these jurisdictions. A negative or unavailable response therefore cannot distinguish a wrong address from missing reference data. A decline rule based on that signal alone turns away cardholders whose addresses are correct. Risk assessment rests on the issuer’s country, taken from the BIN database. The billing country is still used to calculate tax and to arrange delivery.

Sanctions and anti-money laundering screening, on the other hand, needs the customer’s actual country. Delegated Regulation (EU) 2025/1184 took effect on August 5, 2025. Since then, any obliged entity in the EU must apply enhanced due diligence whenever a business relationship or transaction involves Monaco. Those measures are triggered by the country recorded in the customer file. A file that lists Monaco residents under France therefore never triggers them. The failure shows up in no individual file, since each looks complete for the country it records.

Delivery depends on customs borders, which match none of the three groups described above. A parcel to Monaco is a French domestic shipment, with no customs formalities. A parcel to the Isle of Man is a UK shipment, inside the UK customs union. A parcel to Andorra, San Marino, Liechtenstein, Jersey, Guernsey, or Gibraltar crosses a customs border and needs a declaration, with the delays and costs that come with it. These borders follow neither the currency nor the payments law regime. A single delivery time quoted for all of Europe therefore does not hold for these six destinations, where customs clearance adds to transit time.

The remedies available to customers vary by jurisdiction, and none covers all nine. Complaints about financial providers in the Channel Islands go to the Channel Islands Financial Ombudsman, which covers Jersey, Guernsey, Alderney, and Sark. The Isle of Man has its own financial services ombudsman scheme. Liechtenstein stays within the European framework, with the FMA as the competent authority and the EFTA Surveillance Authority above it. Monaco, Andorra, and San Marino refer customers to their own courts and national authorities, with no link to EU out-of-court dispute resolution bodies.

• Add all nine countries to the order form, each with its own ISO 3166 code, and remove format checks that assume a national postal code.
• Store the billing country and the issuer’s country separately in the data model, and key the SCA exemption engine to the issuer’s country.
• Add Monaco to the enhanced due diligence list, under Delegated Regulation (EU) 2025/1184, without relying on the link to France inherited from the address system.
• Set tax rules by jurisdiction: French VAT for Monaco, the UK regime for the Isle of Man, export treatment for the other six, and Jersey GST once the registration threshold is exceeded.
• Document personal data transfers, relying on the existing adequacy decisions for Andorra, Jersey, Guernsey, and the Isle of Man, and on appropriate safeguards for Monaco, San Marino, and Gibraltar.
• Verify every license in the named authority’s register, require the license number, and never confuse the two commissions that share the acronym GFSC.