Final Report on Guidelines on ancillary services undertakings

EBA/GL/2026/01 9 January 2026 Final Report Guidelines on ancillary services undertakings specifying the criteria for the identification of activities referred to in Article 4(1)(18) of Regulation (EU) No 575/2013

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 2 Table of Contents Final Report 1

1. Executive Summary 4 Next steps 5
2. Background and rationale 6 2.1. Rationale and objective of the guidelines 7 2.1.1. General provisions 8 2.1.2. Direct extension of banking 9 2.1.3. Ancillary to banking 10 2.1.4. Other similar activity 12 2.1.5. Principal activity of an ancillary services undertaking 13
3. Guidelines 14
4. Compliance and reporting obligations 16 Status of these guidelines 16 Reporting requirements 16
5. Subject matter, scope and definitions 17 Subject matter Scope of application Addressees Definitions 17
6. Implementation 18 Date of application 18
7. Guidelines on ancillary services undertakings 19 4.1. General provisions 19 4.2. Criteria to determine activities to be considered a direct extension of banking under Article 4(1)(18)(a) of Regulation (EU) No 575/2013 19 4.3. Criteria to determine activities to be considered ancillary to banking under Article 4(1)(18)(b) of Regulation (EU) No 575/2013 20 General criteria 20 Operational leasing 22 Ownership or management of property 22 Provision of data processing services 23 4.4. Determination of activities to be considered similar to points (a) and (b) under Article 4(1)(18)(c) of Regulation (EU) No 575/2013 24

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 3 4.5. Principal activity of an ancillary services undertaking 24 5. Accompanying documents 25 5.1. Cost-benefit analysis / impact assessment 25 A. Problem identification 25 B. Policy objectives 26 C. Baseline scenario 26 D. Options considered, Cost-Benefit Analysis and Preferred option 27 5.2. Feedback on the public consultation 32 Summary of key issues and the EBA’s response 32 Summary of responses to the consultation and the EBA’s analysis 36

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 4

1. Executive Summary Regulation (EU) 2024/1623 of the European Parliament and of the Council of 31 May 2024 (Regulation (EU) 2024/1623) amending Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 (Regulation (EU) No 575/2013) has amended, among others, the definitions of “ancillary services undertaking” and “financial institution” under points (18) and (26) of Article 4(1) Regulation (EU) No 575/2013, respectively. Those changes aim to promote more clarity in the previous definitions, ensure a consistent application of the consolidation framework across Member States and allow supervisors to better detect and address the risks that groups are exposed to on a consolidated basis. Article 4(5) of Regulation (EU) No 575/2013, as amended by Regulation (EU) 2024/1623, mandates the EBA to issue guidelines, in accordance with Article 16 of Regulation (EU) No 1093/2010, to specify the criteria for the identification of activities referred to in paragraph 1, first subparagraph, point (18) of Article 4 of Regulation (EU) No 575/2013. Those activities refer to (i) activities that should be considered a direct extension of banking under point (a); (ii) operational leasing, the ownership or management of property, the provision of data processing services or any other activity insofar as those activities are ancillary to banking under point (b); and (iii) any other activity considered similar by the EBA to those referred to in points (a) and (b) of Article 4(1)(18) of Regulation (EU) No 575/2013. The guidelines contain five sections: (i) General provisions; (ii) Criteria to determine activities to be considered a direct extension of banking under Article 4(1)(18)(a) of Regulation (EU) No 575/2013; (iii) Criteria to determine activities to be considered ancillary to banking under Article 4(1)(18)(b) of Regulation (EU) No 575/2013; (iv) Determination of activities to be considered similar to points (a) and (b) under Article 4(1)(18)(c) of Regulation (EU) No 575/2013; and (v) Principal activity of an ancillary services undertaking. Previous work carried out by the EBA and related findings on the regulatory perimeter and consolidation issues1 , as well as the recommendations provided in the 2022 Joint ESA response to the Commission’s Call for Advice on digital finance2 , have been duly taken into account in the development of these guidelines. In addition, existing practices followed by competent authorities have also been considered. 1 EBA Report on other financial intermediaries and regulatory perimeter issues. 2 2022 Joint ESA response to Commission’s Call for Advice on digital finance.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 5 These guidelines elaborate on (i) the activities that should be considered a direct extension of banking; (ii) the activities that should be considered ancillary to banking, with respect to operational leasing, the ownership or management of property and the provision of data processing services and also to other activities that either support, complement or rely on banking; and (iii) the process to determine the activities considered similar by EBA to those referred to in points (a) and (b) of Article 4(1)(18) of Regulation (EU) No 575/2013. Next steps The guidelines will be translated into the official EU languages and published on the EBA website. The deadline for competent authorities to report whether they comply with the guidelines will be two months after the publication of the translations.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 6 2. Background and rationale

1. Ancillary services undertakings (ASUs) are an integral part of the banking business, particularly when they are closely linked to banking functions such as lending, payment services, or asset management. ASUs encompass a wide range of activities that represent a direct extension of banking, as well as other ancillary activities such as the ownership or management of property, operational leasing or the provision of data processing services, insofar as these activities are ancillary to banking. While these are not primary financial activities, they play an important role in the overall functioning and efficiency of institutions and financial institutions. Their qualification as ASUs is therefore of paramount importance to ensure that, from a prudential perspective, the risks associated with their activities are integrated into the overall risk management framework and sufficient capital is held to cover for the risks stemming from their operations.
2. In November 2017, the EBA published an opinion and a report on issues related to other financial intermediaries and regulatory perimeter issues. In that opinion, the EBA noted that the definitions of “ancillary services undertaking” and “financial institution” set out in points (18) and (26) of Article 4(1) of Regulation (EU) No 575/2013 were prone to varying interpretations across the Member States, leading to potential inconsistencies in the way the consolidation rules under Article 18 of Regulation (EU) No 575/2013 are applied. Moreover, in January 2022, the Joint ESA response to the Commission’s Call for Advice on digital finance stressed that prudential rules as envisaged by Regulation (EU) No 575/2013 at that time might not have adequately captured the specific nature and inherent risks of new combinations of activities carried out by emerging mixed activity groups, including BigTech and FinTech companies, which may perform financial activities but fall outside the scope of consolidation under Regulation (EU) No 575/2013.
3. The new EU banking package has amended and clarified these definitions, among others related to prudential consolidation, to ensure a proper supervisory assessment of the risks to which a banking group is exposed on a consolidated level, while allowing flexibility to adapt to new sources of risk. The revised definitions also aim to ensure that undertakings providing digital activities ancillary to banking are included in the scope of prudential consolidation, including when they head a banking group.
4. Following the amendments of Regulation (EU) 2024/1623, ASUs are defined as undertakings whose principal activity consists of: (a) a direct extension of banking; (b) operational leasing, ownership or management of property, provision of data processing services or any other activity insofar as these are ancillary to banking; or (c) any other activity considered similar by the EBA to those referred to in points (a) and (b), in accordance with Article 4(1)(18) of Regulation (EU) No 575/2013. In addition, ASUs fall

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 7 under the definition of “financial institution” in Article 4(1)(26) of Regulation (EU) No 575/2013 and, as such, qualify as financial sector entities under Article 4(1)(27) of Regulation (EU) No 575/2013, and may qualify as financial holding companies or count towards the indicators set out in point (20) of that Article. 5. While the amended definitions address existing discrepancies and close loopholes in the regulatory provisions concerning prudential consolidation, further clarification is needed regarding the criteria for determining which activities fall under points (a), (b) and (c) of Article 4(1)(18) of Regulation (EU) No 575/2013. Additional guidance is also required on certain concepts such as “operational leasing” and “principal activity of an ancillary services undertaking”, to ensure consistent practices and to promote supervisory convergence in the qualification of ASUs across Member States. 2.1. Rationale and objective of the guidelines 6. The purpose of these guidelines is to establish clear, simple and consistent criteria for the identification of activities that fall under the definition of ASU in accordance with Article 4(1)(18) of Regulation (EU) No 575/2013. The overarching objective is to promote harmonised practices across the EU, ensuring a level playing field and greater comparability of prudential requirements. 7. In this regard, the guidelines provide the criteria, together with a list of activities, that should be used to determine whether an undertaking performs activities that qualify as “direct extension of banking” within the meaning of Article 4(1)(18)(a) of Regulation (EU) No 575/2013. The guidelines also provide criteria for institutions to determine when the activity of an undertaking supports, complements or relies on banking in a way that should be considered “ancillary to banking” within the meaning of point (b) of the same Article. Additional consideration is given to those activities that are listed in point (b) (i.e. operational leasing, the ownership or management of property, and the provision of data processing services), for which further specifications are provided. In addition, to determine which activities should be considered by the EBA similar to those referred to in points (a) and (b) of Article 4(1)(18) of Regulation (EU) No 575/2013, the guidelines describe the procedure that should be followed on a case-by-case basis. 8. These guidelines also provide clarifications on concepts embedded in the ASU definition and therefore essential for its proper application, such as (i) “principal activity of an ancillary services undertaking”, which is determinant for an undertaking to qualify as an ASU; and (ii) “operational leasing” as one of the activities mentioned in that Article. These concepts have been clarified relying, to the extent possible, on existing definitions or on similar approaches already set out in other parts of the prudential framework. 9. Following the three-month public consultation period, which ran from 7 July to 7 October 2025, certain criteria originally provided in the Consultation Paper have been revised. Specifically, two proposed criteria for identifying activities considered a “direct

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 8 extension of banking” have been removed to ensure a more proportional application of the guidelines. 10. Regarding the specific treatment of undertakings collectively owned by IPS members, their explicit reference has been also removed from the final guidelines. This is because the scope of application for the ancillary assessment, in line with Article 18(5) of Regulation (EU) No 575/2013, already allows capturing undertakings in which IPS members hold a direct or indirect participation or other capital ties. Finally, other limited amendments have been introduced to clarify certain concepts used for developing the guidelines (e.g. reference to “banking”). 11. These guidelines are structured into five main sections that specify the criteria to be applied under Article 4(1)(18) of Regulation (EU) No 575/2013. However, the assessment of qualification as an ASU should be performed holistically and any undertaking performing activities that meet the criteria set out in Sections 4.2 to 4.4 as its principal activity should be regarded as an ASU under Article 4(1)(18) of Regulation (EU) No 575/2013. 2.1.1. General provisions 12. The guidelines clarify that undertakings should not be regarded as ASU if (i) they are explicitly excluded from the definition of a financial institution under Article 4(1)(26)(a) of Regulation (EU) No 575/2013, or (ii) they are already included in the definition of financial sector entity under point (27) of Article 4(1) of Regulation (EU) No 575/2013, for any other reason than being an ASU. 13. Regarding Collective Investment Undertakings (CIUs), the guidelines remain consistent with the clarifications previously provided by the EBA3 . Under the current framework, and as an exception to the general rule, CIUs should be considered financial institutions only if their principal activity consists of one or more of the activities listed in Article 4(1)(26)(b)(i)4 of Regulation (EU) No 575/2013 or when regarded as ASU where they meet the conditions set out in Regulation (EU) No 575/2013 and the criteria specified in these guidelines5 . 3 See EBA Q&A 2015_2383 and the Final report on RTS on methods of prudential consolidation. 4 In accordance with Article 4(1)(26)(b)(i) of Regulation (EU) No 575/2013, undertakings performing as their principal activity the acquisition or ownership of holdings, one or more of the activities listed in Annex I, points 2 to 12 and points 15, 16 and 17, to Directive 2013/36/EU, or one or more of the services or activities listed in Annex I, Section A or B, to Directive 2014/65/EU in relation to financial instruments listed in Annex I, Section C, to Directive 2014/65/EU, shall qualify as financial institutions provided that the criteria laid down in point (a) of that Article is complied with. 5 The manner and extent to which CIUs should be included in the prudential scope of consolidation are determined by Article 11 and Article 18 of Regulation (EU) No 575/2013 and the criteria provided in the Commission Delegated Regulation (EU) 2022/676. Additional clarifications on the implementation of such provisions and interaction with the specific treatment set out in Articles 132 and 152 of Regulation (EU) No 575/2013 are provided in the Report on prudential consolidation.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 9 14. Finally, it is clarified that an ASU included in the consolidated situation of an institution should be regarded as an ASU for any other undertaking. In the past, similar considerations were applied in the definition of “financial sector entity” under Regulation (EU) No 575/20136 . By applying the same principle, the guidelines promote supervisory convergence and avoid situations where an undertaking included in the consolidated prudential scope of an institution could be treated differently across groups, thereby safeguarding the integrity of prudential requirements. 2.1.2. Direct extension of banking 15. In accordance with Article 4(1)(18)(a) of Regulation (EU) No 575/2013, an undertaking should be regarded as an ASU when its principal activity is a direct extension of banking. The guidelines specify that activities which are fundamental to the value chain of core banking services, as referred to in points 1, 2 and 6 of Annex I to Directive 2013/36/EU, should be considered a direct extension of banking. Their inclusion reflects the need to capture functions that, while not always performed directly by institutions or financial institutions, are inherently financial in nature and essential for delivering banking products and managing associated risks. 16. The abovementioned activities refer to: a. the brokerage of commercial or residential loans or deposits; b. loan servicing, including where carried out by credit servicers within the meaning of Article 3(8) of Directive (EU) 2021/2167; c. creditworthiness assessment of individual clients of an institution or a financial institution; d. debt recovery; e. valuation of collateral; f. acquisition, ownership, management, and liquidation of repossessed assets; and g. loan intermediation and distribution through innovative channels such as crowdfunding services, peer-to-peer platforms, or marketplace lending, where these activities contribute to lending. 17. The activities listed in points (a) to (f) should be considered a direct extension of banking only where mainly provided to or in the interest of institutions or financial institutions. 6 Prior to the amendments introduced by Regulation (EU) 2024/1623, the definition of “financial sector entity” included “an ancillary services undertaking included in the consolidated financial situation of an institution”.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 10 18. With regard to point (c), the assessment of creditworthiness of individual clients should not include the activities of credit rating agencies. This exclusion is justified by the fact that credit rating agencies provide ratings for market purposes, rather than assessing individual clients for lending decisions. Their role is distinct from that of undertakings performing credit risk evaluations that support lending decisions within a banking group. 19. As regards point (g), the acquisition, ownership, management, and liquidation of repossessed assets is meant to capture undertakings that perform those activities on behalf of or for the benefit of an institution or financial institution, particularly as part of a non-performing loan recovery strategy – i.e. with the objective of recovering the value for the institution or financial institution. 20. To determine whether an undertaking performs “direct extension of banking” activities, the assessment should be carried out for all undertakings, whether inside or outside of the group. This broad scope is necessary because such activities, by their intrinsic nature, can generate risks similar to those of institutions or financial institutions, regardless of their position within the group structure. Capturing both categories ensures a level playing field, prevents regulatory arbitrage, and promotes supervisory convergence in the treatment of activities that materially affect the risk profile of banking groups. Therefore, their qualification as ASUs should be ensured in all circumstances. 2.1.3. Ancillary to banking 21. In accordance with Article 4(1)(18)(b) of Regulation (EU) No 575/2013, an undertaking should be regarded as an ASU when its principal activity encompasses operational leasing, the ownership or management of property, the provision of data processing services or any other activity insofar as it is ancillary to banking. 22. In this context, it is important to note that the concept of “ancillary services undertaking” under Article 4(1)(18) of Regulation (EU) No 575/2013 has evolved following the amendments introduced by Regulation (EU) 2024/1623. While the previous definition referred to entities the principal activity of which consists of owning or managing property, managing data processing services, or a similar activity which is ancillary to the principal activity of one or more institutions, the revised wording shifts the focus to the existence of links and connections between the undertaking’s activity and the banking business (i.e. “ancillary to banking”). Under this updated approach, the ancillary nature of an undertaking is no longer determined solely by the type of activity it performs, but rather by its function, operational characteristics, and degree of interconnectedness with the banking business. This evolution aims to address the limitations of a predefined list of financial activities, which may not adequately distinguish between undertakings that merely represent investments of a banking group and those that are functionally connected to banking and pose prudential risks that should be appropriately reflected at the consolidated level. A clear link or connection between the activity and banking is therefore required, establishing a specific test to

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 11 assess whether the activities listed in point (b) of Article 4(1)(18) of Regulation (EU) No 575/2013 – or any other activities – are sufficiently connected to banking to be considered ancillary to it. 23. Against this background, the guidelines clarify that an activity should be considered “ancillary to banking” when it either supports, complements, or relies on the provision of any service or activity that qualifies an undertaking as an institution or a financial institution, as set out in Annex I to Directive 2013/36/EU and Annex I to Directive 2014/65/EU. The criteria introduced in these Guidelines define what it means for an activity to support, complement, or rely on banking. The determination whether an activity should be considered “ancillary to banking” is made by assessing the extent to which the activity: a. supports banking, which is the case when an activity significantly improves the efficiency and effectiveness of banking processes, or enables or facilitates the delivery of banking products and/or services to clients; b. complements banking, which occurs when cross-selling practices and specific distribution and marketing channels allow to expand the offer of banking or ancillary services; and/or c. relies on banking, which occurs when the activity depends significantly on relevant banking products or services, or on funding provided by an institution or financial institution of the group. 24. It is worth noting that the reliance on funding criterion is intended to capture only those undertakings that have a material link with an institution or financial institution of a banking group. Therefore, due consideration should be given to the relevance of the funding when assessing the existence of such a link. This also implies that, for activities not explicitly listed in the definition of ASU under Article 4(1)(18) of Regulation (EU) No 575/2013 (i.e. activities other than operational leasing, ownership or management of properties, or provision of data processing services), the relevance of funding should be deemed present only when the activity is connected to, or closely related to, the activity of an institution or financial institution within the group. 25. The assessment should be conducted holistically, noting that multiple dimensions may be fulfilled simultaneously. The significance of the relationship between the undertaking’s activities and banking should also be considered, ensuring that only activities with a material link to banking operations are captured, while those with negligible connections are disregarded. 26. To ensure consistent application of the general principles for assessing the ancillary nature of any activity, the guidelines provide further details on how to assess the criteria for the activities explicitly listed in Article 4(1)(18)(b) of Regulation (EU) No 575/2013 –

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 12 i.e. operational leasing, the ownership or management of property, and the provision of data processing services. Specific examples are provided to illustrate when these activities may support banking (e.g. the provision of data processing services supporting lending operations), complement it (e.g. evident cross-selling between the two activities), or rely on it (e.g. significant funding provided by an institution or financial institution of the group to the undertaking). 27. The assessment of whether an activity is ancillary to banking should be limited to cases where a meaningful connection with banking exists. Such a connection is considered to arise when the activity is performed by an undertaking that – when regarded as ASU – must or may be included in the prudential consolidation of the institution (“banking group”). This approach ensures proportionality by preventing other undertakings not linked to the banking business from being qualified as ASUs and consequently treated as financial institutions for other regulatory purposes (e.g. credit risk framework and deduction regime for financial sector entities). 28. In this regard, cases where an undertaking has to or may be subject to prudential consolidation should encompass all those envisaged by Articles 11 and 18 of Regulation (EU) No 575/2013, including parent undertakings, subsidiaries, and joint arrangements, along with situations of significant influence, unified management, or single management determined in accordance with the Regulation (EU) 2022/676. Moreover, the ancillary assessment is also required when the undertaking, if qualified as an ASU, either meets the definition of financial holding company itself or contributes to another undertaking being considered a financial holding company, in accordance with Article 4(1)(20)(d) of Regulation (EU) No 575/2013. 2.1.4. Other similar activity 29. For the purposes of Article 4(1)(18)(c) of Regulation (EU) No 575/2013, the guidelines set out the process and assessment criteria to be followed for the identification of additional activities that the EBA may consider similar to those referred to in points (a) and (b) of that Article. This approach is intended to ensure that the guidelines remain responsive to emerging sources of risk, including those stemming from activities that do not fully meet the conditions for being classified as a direct extension of banking or as ancillary to banking. Otherwise, undertakings performing these activities may not be captured as ASUs, despite their potential relevance for the risk profile of a banking group. 30. To operationalise this approach, the process can be triggered either by the competent authority or by the institution concerned when identifying activities that may be considered similar but are not already captured by these guidelines. In cases where the institution identifies such activities, it should report them to its relevant competent authority, which will initiate a case-by-case assessment and inform the EBA. The final decision will be taken by the EBA, which will evaluate the activity against the criteria to

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 13 establish the similarity and, where necessary, update the list of activities considered similar. This will ensure transparency, consistency, and alignment across Member States. 2.1.5. Principal activity of an ancillary services undertaking 31. More specifically, these guidelines specify that an undertaking should be considered as performing activities referred to in points (a), (b) or (c) of Article 4(1)(18) of Regulation (EU) No 575/2013 as its principal activity when certain thresholds are met. The approach envisaged is similar to the one used for identifying a “financial holding company” under Article 4(1)(20) of Regulation (EU) No 575/2013. Accordingly, a list of indicators is provided, including all those relevant to financial holding companies, except for the equity indicator, as its use would not be feasible for assessing the principal activity of an undertaking on an individual basis. 32. The assessment of the principal activity for the qualification of an undertaking as an ASU should be carried out on a cumulative basis. This means that if an undertaking engages in more than one activity falling within the scope of these guidelines, all such activities should be considered collectively in the assessment of its principal activity. A cumulative approach is deemed necessary because undertakings often perform a combination of activities that, taken individually, may not meet the thresholds but, when aggregated, represent a significant link to banking and therefore pose prudential risks comparable to core banking functions. Without this holistic view, there is a risk of underestimating the overall risk exposure and misaligning the prudential perimeter. 33. At the same time, the guidelines acknowledge that the determination of the principal activity may not always be straightforward, particularly in complex or evolving business models. For this reason, in those cases where none of the thresholds set out in these guidelines are met, an activity can be regarded as an undertaking’s principal activity on a case-by-case basis to the satisfaction of the competent authority. This option should be exercised through a transparent, case-by-case assessment, promoting proportionality in its application.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 14 3. Guidelines

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 15 EBA/GL/2026/01 09 January 2026 Guidelines specifying the criteria for the identification of activities referred to in Article 4(1)(18) of Regulation (EU) No 575/2013

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 16

1. Compliance and reporting obligations Status of these guidelines
2. This document contains guidelines issued pursuant to Article 16 of Regulation (EU) No 1093/20107 . In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities and financial institutions must make every effort to comply with the guidelines.
3. Guidelines set the EBA view of appropriate supervisory practices within the European System of Financial Supervision or of how Union law should be applied in a particular area. Competent authorities as defined in Article 4(2) of Regulation (EU) No 1093/2010 to whom guidelines apply should comply by incorporating them into their practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where guidelines are directed primarily at institutions. Reporting requirements
4. According to Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must notify the EBA as to whether they comply or intend to comply with these guidelines, or otherwise with reasons for non-compliance, by 04/05/2026. In the absence of any notification by this deadline, competent authorities will be considered by the EBA to be non-compliant. Notifications should be sent by submitting the form available on the EBA website with the reference “EBA/GL/2026/01”. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities. Any change in the status of compliance must also be reported to EBA.
5. Notifications will be published on the EBA website, in line with Article 16(3). 7 Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC, (OJ L 331, 15.12.2010, p.12).

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 17 2. Subject matter, scope and definitions Subject matter 5. These guidelines specify, in accordance with Article 4(5) of Regulation (EU) No 575/2013, the criteria for the identification of activities referred to in paragraph 1, first subparagraph, point (18) of Article 4 of Regulation (EU) No 575/2013, for the purposes of determining an ancillary services undertaking as defined in Article 4(1)(18) of Regulation (EU) No 575/2013 (“ancillary services undertaking” – “ASU”). Scope of application 6. These guidelines apply in accordance with the level of application set out in Title II of Part One of Regulation (EU) No 575/2013. 7. These guidelines apply in relation to the qualification of any undertaking as “ancillary service undertaking” in accordance with paragraph 1, first subparagraph, point (18) of Article 4 of Regulation (EU) No 575/2013. Addressees 8. These guidelines are addressed to competent authorities as defined in Article 4, points 2(i) and (viii) of Regulation (EU) No 1093/2010, to competent authorities as defined in Article 3(1)(35) of Regulation (EU) 2023/1114, and to financial institutions as defined in Article 4(1) of Regulation (EU) No 1093/2010. Definitions 9. Unless otherwise specified, the terms used and defined in Regulation (EU) No 575/2013, Directive 2013/36/EU and Directive 2013/34/EU have the same meaning in these guidelines.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 18 3. Implementation Date of application 10. These guidelines apply from 04/05/2026.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 19 4. Guidelines on ancillary services undertakings 4.1. General provisions 11. An undertaking should not be regarded as an ASU, where one of the following conditions is met: a. it is a pure industrial holding company, a securitisation special purpose entity, an insurance holding company as defined in Article 212(1), point (f), of Directive 2009/138/EC or a mixed-activity insurance holding company as defined in Article 212(1), point (g), of that Directive, except where a mixed-activity insurance holding company has a subsidiary institution; or b. it already falls within the definition of institution, financial institution or financial sector entity under points (3), (26) and (27) of Article 4(1) of Regulation (EU) No 575/2013, for any reason other than being an ASU. 12. An ASU included in the consolidated situation of an institution should be regarded as an ASU for any other undertaking. 4.2. Criteria to determine activities to be considered a direct extension of banking under Article 4(1)(18)(a) of Regulation (EU) No 575/2013 13. Activities that are fundamental to the value chain of core banking services referred to in points 1, 2 and 6 of Annex I to Directive 2013/36/EU should be considered a direct extension of banking. These activities include the following: a. the brokerage of commercial or residential loans or deposits; b. loan servicing, including where it is carried out by credit servicers within the meaning of Article 3(8) of Directive (EU) 2021/2167; c. creditworthiness assessment of individual clients of an institution or a financial institution; d. debt recovery; e. valuation of collateral;

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 20 f. acquisition, ownership, management and liquidation of repossessed assets; and g. loan intermediation and distribution through innovative channels such as crowdfunding services, peer-to-peer platforms, or marketplace lending, where these activities contribute to lending. 14. The activities listed in points (a) to (f) should be considered a direct extension of banking only when they are mainly provided to or carried out in the interest of institutions or financial institutions. 4.3. Criteria to determine activities to be considered ancillary to banking under Article 4(1)(18)(b) of Regulation (EU) No 575/2013 General criteria 15. An activity should be identified as “ancillary to banking” when it either supports, complements or relies on the provision of any service or activity listed in Annex I, points 1 to 12 and points 15,16 and 17 to Directive 2013/36/EU and in Annex I, Section A or B to Directive 2014/65/EU, in relation to the financial instruments listed in Annex I, Section C to Directive 2014/65/EU, by an institution or financial institution (“supports, complements or relies on banking”). 16. For the purposes of assessing whether activities are ancillary to banking, based on the criteria set out in paragraph 15, the assessment should be: a. limited to the activities performed by undertakings that, when considered ASU, have to or may be subject to prudential consolidation in accordance with Articles 11 and 18 of Regulation (EU) No 575/2013 and the criteria provided by Regulation (EU) 2022/676. This includes parent undertakings, subsidiaries, and joint arrangements, along with any other situations specified in paragraphs (3), (5), and points (a) and (b) of paragraph (6) of Article 18 of Regulation (EU) No 575/2013; and b. performed taking into account the relevance of the link or connection of the activity to that of an institution or financial institution referred to in paragraph 15. Supports banking 17. For the purposes of paragraph 15, an activity supports banking when it significantly improves the efficiency and effectiveness of banking processes or enables or facilitates the delivery of banking products and/or services to clients. The provision of such supporting services to other ASUs of the group should be considered indirect support.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 21 18. Without prejudice to paragraph 17, the following should be seen as activities that support banking: a. operational support, such as process optimisation and infrastructure development and maintenance; b. customer relationship support, such as facilitation of the interaction between customers and the bank (e.g. customer service platforms); c. risk management and regulatory compliance support; d. strategic and competitive support, such as market research, big data analytics, innovation and digital transformation, or marketing activities; e. back-office and administrative support, such as human resources management or document management. Complements banking 19. For the purposes of paragraph 15, an activity complements banking when: a. it allows an institution or financial institution of the group, by means of specific distribution and marketing channels, to expand the offer of its banking services and products to customers of the undertaking; or b. the non-banking services and products of the undertaking, by means of specific distribution and marketing channels, are offered and provided to the customer base of an institution or financial institution of the group. 20. The determination of whether an activity complements banking should rely on an objective and factual assessment and not be based on the abstract possibility of the institution or financial institution or the undertaking to offer its services and products to the same customer base. Relies on banking 21. For the purposes of paragraph 15, an activity relies on banking when: a. it significantly relies on relevant banking products or services provided by an institution or a financial institution of the group to perform its activity (e.g. KYC, management of loan applications, credit risk assessment). In this regard, operational and personnel dependencies should be part of the assessment; or b. it significantly relies on funding provided by an institution or financial institution of the group to finance the provision of products or services that are part of its activity.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 22 Institutions should not only consider the financing received by the undertaking but also evaluate the existence of any explicit commitment to provide funding. Operational leasing 22. For the purposes of these guidelines, operational leasing should refer to a leasing contract that does not substantially transfer to the lessee all the risks and rewards incidental to ownership of the leased asset. 23. In line with the general criteria provided in paragraphs 15 to 21, operational leasing activities should be considered ancillary to banking, in any of the following illustrative situations: a. the leasing of assets is provided to institutions or financial institutions within or outside the group (e.g. leasing of buildings or premises); b. the leasing of assets is complemented by the offer and sale, on a recurring basis, of banking products or services to the lessee through an institution or financial institution of the group (e.g. current account or payment services); or c. the leasing of assets relies significantly on the banking business, including situations when the undertaking: i. significantly relies on relevant banking products or services provided by an institution or financial institution of the group. For instance, where (i) the contract initiation and processing rely on the credit risk assessment performed by an institution or a financial institution of the group; or (ii) the collection of the leasing payments – or any actions to recover the operational leasing claims or underlying assets – is managed by an institution or financial institution of the group; or ii. significantly relies on funding provided by institutions or financial institutions of the group. Ownership or management of property 24. In line with the general criteria provided in 15 to 21, the ownership or management of property activities should be considered ancillary to banking, in any of the following illustrative situations: a. the activity supports banking, including situations where: i. the properties owned or managed by the undertaking are used to support the operations of banking business (e.g. bank branches or head offices); or

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 23 ii. the undertaking properties’ ownership arises as a direct result of banking business. b. the activity complements banking, including situations where: i. the undertaking actively markets to its clients complementary banking products or services (e.g. mortgages) that support the group cross-selling strategy; ii. institutions or financial institutions of the group actively offer and sell to their clients investments in real estate funds, or invest clients’ managed assets in such real estate funds, the properties of which are to a large degree managed by the undertaking; or iii. the property management services of the undertaking (e.g. the management of investment properties for clients) are marketed as a supplementary service to those of banking (e.g. portfolio management). c. the activity significantly relies on banking, including situations where: i. for the funding of properties owned or developed, the undertaking significantly relies on financing from institutions or financial institutions of the group; or ii. the undertaking relies on certain banking products or services provided by institutions or financial institutions of the group to carry out its activities. These services should include projects’ financial risk assessment, risk management, compliance support, or other services which demonstrate a high level of interconnectedness and dependency of the undertaking. Provision of data processing services 25. In line with the general criteria provided in 15 to 21, the provision of data processing services should be considered ancillary to banking, in any of the following illustrative situations: a. it supports banking, ensuring that banking operations are carried out effectively (e.g. development and/or maintenance of operating systems supporting the banking operations). The provision of such data processing services to other ASUs of the group should also be deemed as indirectly supporting banking; b. it complements banking, for instance, by enhancing, adding value to, or complementing banking products or services. Systematic cross-selling practices and common distribution channels should be taken into account in that respect; or

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 24 c. it substantially relies on banking, for instance, where the data processing services significantly rely on data provided by or linked to the banking activities (e.g. provision of client payment data analytics). 4.4. Determination of activities to be considered similar to points (a) and (b) under Article 4(1)(18)(c) of Regulation (EU) No 575/2013 26. For the purpose of application of Article 4(1)(18)(c) of Regulation (EU) No 575/2013, competent authorities should notify the EBA without undue delay of an activity that can be deemed similar to those referred under point (a) and (b), identifying the relevant undertaking performing the activity and explaining why its activity should be seen as similar also in accordance with these guidelines. 27. The EBA should apply these guidelines to determine whether the activity notified in accordance with paragraph 26 is similar to the activities referred to in Article 4(1)(18), points (a) and (b) of Regulation (EU) No 575/2013. 4.5. Principal activity of an ancillary services undertaking 28. An undertaking should be regarded as performing activities referred to in points (a), (b) or (c) of Article 4(1)(18) of Regulation (EU) No 575/2013 as principal activity, where the total of these activities covers at least 50% of any of the following indicators: a. the undertaking’s assets based on its individual situation; b. the undertaking’s revenues based on its individual situation; c. the undertaking’s personnel based on its individual situation. 29. An activity should be regarded as an undertaking’s principal activity even if none of the thresholds set out in paragraph 28 is met, where this can be established on a case-by￾case basis to the satisfaction of the competent authority.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 25 5. Accompanying documents 5.1. Cost-benefit analysis / impact assessment Article 4(5) of Regulation (EU) No 575/2013, as amended by Regulation (EU) 2024/1623, mandates the EBA to issue guidelines, in accordance with Article 16 of Regulation (EU) No 1093/2010, specifying the criteria for the identification of activities referred to in Article 4(1)(18) of Regulation (EU) No 575/2013. In accordance with Article 16(2) of Regulation (EU) No 1093/2010, the EBA shall, where appropriate, conduct open public consultations regarding the guidelines and recommendations and analyse the potential costs and benefits. To this end, the present section provides a cost-benefit analysis, with an overview of the existing issues that the guidelines are meant to address, as well as the options proposed to tackle these issues and their potential impact. Given the nature and the scope of the guidelines, the analysis is high level and qualitative in nature. A. Problem identification Regulation (EU) 2024/1623 amending Regulation (EU) No 575/2013 has replaced point (18) of Article 4(1) of Regulation (EU) No 575/2013 thereby amending the “ancillary services undertaking” (“ASU”) definition. The revised definition provides that ASU means an undertaking the principal activity of which, whether provided to undertakings inside the group or to clients outside the group, consists of any of the following: (a) a direct extension of banking; (b) operational leasing, the ownership or management of property, the provision of data processing services or any other activity insofar as those activities are ancillary to banking; (c) any other activity considered similar by the EBA to those referred to in points (a) and (b). In that regard, the EBA is mandated in accordance with Article 4(5) of Regulation (EU) No 575/2013 to issue guidelines specifying the criteria for the identification of activities referred to in Article 4(1)(18) of that Regulation. These guidelines therefore elaborate on (i) the activities that should be considered a direct extension of banking; (ii) how to identify activities that are ancillary to banking not only with reference to operational leasing, the ownership or management of property or the provision of data processing services but also with reference to any other activity insofar as those are ancillary to banking; (iii) the criteria and process that the EBA will apply to identify activities considered similar to those referred to in points (a) and (b). The primary problem that the guidelines aim to address is the potential lack of harmonised practices and divergences in the identification of ASUs across Member States, which is crucial

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 26 for the application of prudential requirements in accordance with Regulation (EU) No 575/2013. This lack of harmonisation may lead to inconsistent approaches in the determination of the regulatory perimeter of consolidation and in compliance with the obligations laid down in Regulation (EU) No 575/2013 on a consolidated basis in accordance with Articles 18 and 11 of that Regulation, respectively, the application of the deduction regime for financial sector entities and the credit risk framework. B. Policy objectives The objective of the guidelines is to establish convergence of institutions and supervisory practices regarding the application of the definition of ASUs by providing clear and objective criteria for the identification of ASUs. Generally, the guidelines seek to create a level playing field, promote convergence of institutions’ practices and enhance comparability of prudential requirements across the EU. They are intended to ensure that institutions are able to identify and properly qualify as ASU those undertakings that perform activities that are either (a) a direct extension of banking, (b) ancillary to banking, or (c) any other activity similar to those referred to previously, when determined by the EBA. Moreover, the guidelines are expected to facilitate the supervision carried out by competent authorities and the analysis of the risks that banking groups are exposed to on a consolidated basis. C. Baseline scenario Institutions, financial holding companies and mixed financial holding companies supervised under Directive 2013/36/EU shall comply with Regulation (EU) No 575/2013 which lays down uniform rules concerning prudential requirements in relation to, among others: (i) own funds, (ii) capital requirements, (iii) large exposures limits, (iv) leverage ratio, and (v) reporting. For the purposes of that Regulation, institutions, financial holding companies and mixed financial holding companies supervised under Directive 2013/36/EU shall apply the definitions laid down in Article 4(1) of Regulation (EU) No 575/2013, which include the definition of ASU. The notion of ASU is relevant for the proper application of the prudential framework set out by Regulation (EU) No 575/2013. In particular, it is important for determining the regulatory perimeter of consolidation and for compliance with the obligations laid down in Regulation (EU) No 575/2013 on a consolidated basis in accordance with Articles 11 and 18 of that Regulation, the application of the deduction regime for financial sector entities and for the credit risk framework. In the absence of clear guidelines, harmonisation of practices across Member States may not be achieved. In such a scenario, institutions, financial holding companies, and mixed financial holding companies may apply their own criteria or rely on those established by their respective

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 27 competent authorities, when provided. This could lead to an inconsistent application of the general prudential requirements under Regulation (EU) No 575/2013 which, as a result, may undermine the effective supervision by competent authorities, and lead to an unlevel playing field within the Union. D. Options considered, Cost-Benefit Analysis and Preferred option In drafting these guidelines several policy options were considered with regard to different dimensions to be addressed when specifying the criteria for the identification of activities referred to in Article 4(1)(18) of Regulation (EU) No 575/2013. Direct extension of banking under Article 4(1)(18)(a) of Regulation (EU) No 575/2013 Policy issue 1: Defining the criteria for the identification of activities which qualify as a direct extension of banking Option 1.a: Providing an exhaustive list of activities to be considered a “direct extension of banking”. Option 1.b: Providing criteria to identify activities that should fall within the “direct extension of banking” complemented by examples of activities that meet these criteria. While providing a detailed and exhaustive list of activities was considered to promote consistency and greater convergence across Member States in identifying ASUs, it was acknowledged that this approach might not be operationally feasible. This is primarily due to the wide variety and evolving nature of activities undertaken within banking groups, which makes it challenging to comprehensively capture all relevant business models within a static list. Moreover, this approach may fail to fully reflect the range of risks to which a banking group is exposed at the consolidated level and may not ensure that all the relevant undertakings are considered as financial sector entities. Finally, it was also noted that the mandate of Regulation (EU) No 575/2013 specifically requires the EBA to specify the “criteria” – rather than provide a predefined list – for identifying activities relevant to the definition of ASU. For these reasons, specifying relevant criteria may allow for sufficient flexibility to identify the activities to be considered a direct extension of banking, while accommodating the diversity of business models and ensuring alignment with the mandate. Furthermore, it was considered that, under a criteria-based approach, the guidelines could provide examples of activities that typically meet these criteria. This would support institutions, financial holding companies, and mixed financial holding companies in the application of the definition, thereby reducing uncertainty and easing the compliance burden.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 28 In light of this assessment, the preferred policy option is to provide criteria to identify activities that constitute a “direct extension of banking” complemented by examples of activities that meet these criteria (Option 1.b). Policy issue 2: Relevance of the inclusion of the undertaking in a banking group for the qualification as “direct extension of banking” Option 2.a: Qualification of an activity as a “direct extension of banking” not limited to those performed by undertakings that are part of a banking group. Option 2.b: Limit the qualification of an activity as a “direct extension of banking” to those performed by undertakings that are part of a banking group. For assessing this policy issue, due consideration has been given to the impacts which might arise from the qualification of an activity as a direct extension of banking. With the changes introduced by Regulation (EU) 2024/1623, the implications of qualifying an undertaking as an ASU extend beyond the scope of prudential consolidation. The designation now also impacts, for example, the deduction regime for FSEs 8 and the credit risk framework. This is because, under the new amendments, ASUs are directly classified as financial institutions and therefore qualify as FSEs, unlike under the previous regime, where only those ASUs included in the perimeter of prudential consolidation of an institution were considered FSEs. Nonetheless, the wording of Article 4(1)(18)(a) of Regulation (EU) No 575/2013 refers to activities considered a direct extension of banking without requiring them to be “ancillary to banking” as specified under point (b) of that Article. For this reason, the criteria for identifying such activities should apply to all types of undertakings – regardless of the existence of a link or capital tie with a banking group – as the activities should be assessed based on their intrinsic financial nature. As such, the assessment is intended to be broad in scope and should encompass any undertaking engaging in financial activities, irrespective of a direct ownership link or capital tie with a banking group. This approach also ensures a consistent treatment of the undertakings whose principal activity constitutes a direct extension of banking across the different parts of the prudential framework. This consistency is important because of the implications of qualifying undertakings as FSEs, mentioned above. Based on the above, Option 2.a has been chosen as the preferred option. This approach ensures that the intrinsic financial nature of the activities is appropriately considered and that undertakings performing such activities are treated consistently across different parts of the 8 In accordance with points (h) and (i) of Article 36(1) of Regulation (EU) No 575/2013, significant or not significant investments in FSEs shall be deducted from CET1 instruments in accordance with Articles 45 and 46 of Regulation (EU) No 575/2013.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 29 prudential framework – a consistency that would not be guaranteed under the narrower approach envisaged in Option 2.b. Ancillary to banking under Article 4(1)(18)(b) of Regulation (EU) No 575/2013 Policy issue 3: Defining the criteria for the identification of activities which qualify as ancillary to banking Option 3.a: Providing a set of different criteria tailored to each activity listed in Article 4(1)(18)(b) of Regulation (EU) No 575/2013 and for any other activity not specifically listed in the same Article. Option 3.b: Providing general criteria valid for any activity and some specifications for the activities specifically listed in Article 4(1)(18)(b) of Regulation (EU) No 575/2013. For assessing this policy issue, it was considered that the primary purpose of providing the criteria for the identification of activities as ancillary to banking is to specify under which conditions an activity would clearly signal the existence of a relevant link or connection with banking. In fact, with the amended version of the ASU definition, more emphasis has been given to the relation of the activity with banking and not to the relation with the principal activity of an institution, as previously done. Providing specific criteria tailored to each of the activities explicitly listed in Article 4(1)(18)(b) of Regulation (EU) No 575/2013 (i.e. operational leasing, the ownership or management of property, the provision of data processing services) as well as for any other activity, would have significantly increased the complexity and burden for the addressees of these guidelines. This approach would have required institutions and competent authorities to assess the criteria against any activity that should be considered ancillary to banking, while the potential benefits of such a granular approach are not sufficiently clear. Against this background, it was considered more effective to establish a set of general criteria applicable to any type of activity, for assessing the existence of a link or connection with banking. For the activities explicitly listed, these general criteria could be complemented with specific clarifications, to better support institutions and competent authorities in performing the assessment in those particular cases. Overall, this approach would promote clarity and consistency in application, while also contributing to reducing the compliance burden and implementation costs associated with these guidelines. For the reasons above, Option 3.b has been chosen as the preferred option as it ensures a more proportionate and consistent framework for the identification of the activities to be considered as ancillary to banking, facilitating implementation and reducing unnecessary complexity and compliance costs.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 30 Policy issue 4: Relevance of the inclusion of the undertaking in the banking group for the qualification as “ancillary to banking” Option 4.a: Qualification of an activity as “ancillary to banking” not limited to those performed by undertakings that are part of the banking group. Option 4.b: Limit the qualification of an activity as “ancillary to banking” to those performed by undertakings that are part of the banking group. For assessing this policy issue, due consideration was given to the impacts which might arise from the qualification of an activity listed in Article 4(1)(18)(b) of Regulation (EU) No 575/2013 as “ancillary to banking”. With the changes introduced by Regulation (EU) 2024/1623, the implications of qualifying an undertaking as an ASU extend beyond the scope of prudential consolidation, as it also has an impact, for example, on the deduction regime for FSEs and the credit risk framework. This is because, under the amended provisions, ASUs are directly considered financial institutions and therefore FSEs – differently from the past where the qualification as FSEs was limited only to those ASUs included in the perimeter of prudential consolidation of an institution. The amended ASU definition introduces a specific test to determine when the activities listed in point (b) of Article 4(1)(18) of Regulation (EU) No 575/2013, or any other activity, should be considered ancillary to banking (“ancillary test”). In practice, this implies that it is not the activity itself which determines whether an undertaking qualifies as an ASU, but rather the existence of a significant link or connection to banking. In this regard, such a link or connection could be identified by applying the general criteria set out in these guidelines. Nonetheless, it was also noted that applying these general criteria could lead to the qualification of any undertaking as an ASU – such as those relying on banking funding – even in the absence of any capital connection with a banking group. This could result in a broad range of undertakings that despite operating outside of a banking group are classified as ASUs, and consequently as financial institutions and FSEs, due to the potential relevance of the criteria provided to assess their link or connection to banking. Such a broad application could have unintended consequences – particularly, in relation to the FSEs deduction regime and the credit risk framework. Given these considerations, it was assessed that an activity should only be considered to have a significant link or connection with banking if it is performed by an undertaking that is part of a banking group. Only in such cases can the activity be understood as supporting, complementing or relying on banking, and therefore be deemed ancillary to the banking activities carried out by institutions or financial institutions of that banking group. Moreover, to ensure an effective application of this provision, the assessment needs to be restricted to those undertakings that are part of the banking group of the institution applying these guidelines. This would ensure that the scope of the assessment remains limited to

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 31 parent undertakings, subsidiaries and joint arrangements of the group, along with other cases referred to in the guidelines. Conversely, the classification as ASU of undertakings within other banking groups would be also adequately addressed, given that the guidelines specify that an ASU included in the consolidated situation of one institution should also be considered an ASU for any other undertaking. It was concluded that limiting the application of the general criteria to undertakings that are part of the banking group would therefore still effectively capture within the prudential perimeter of consolidation those that may pose risks to the banking group, while avoiding distortions in other areas of the regulatory framework. Based on the above, Option 4.b has been chosen as the preferred option as it ensures that only undertakings which have a significant link or connection with the banking group, while avoiding the unintended consequences that would arise in case of the broader approach as envisaged in Option 4.a. Other similar activities under Article 4(1)(18)(c) of Regulation (EU) No 575/2013 Option 5.a: Specifying concrete criteria for the identification of activities that are similar to those referred to in points (a) and (b). Option 5.b: Determining a process to be followed for the identification of activities that are similar to those referred to in points (a) and (b). One of the key objectives of the amended definition of ASUs is to introduce greater flexibility into supervisory approaches, enabling competent authorities to better address emerging sources of risk and to capture activities that may not fully meet the criteria set out for the categories referred to in points (a) and (b) of Article 4(1)(18) of Regulation (EU) No 575/2013. Providing a set of criteria or a predefined list of activities could, in principle, enhance predictability and legal certainty. However, this approach was ultimately deemed operationally impracticable. In particular, the feasibility of developing additional criteria or lists beyond those already established for identifying activities as either a direct extension of banking or ancillary to banking was considered limited – especially given that these two categories are expected to already capture most of the relevant activities for identifying ASUs. Moreover, such a static approach would lack the necessary flexibility to reflect technological innovation and the evolving nature of banking business models, which may give rise to new activities not easily classifiable in advance. As such, a rigid approach may risk becoming quickly outdated, which could undermine the objective of a forward-looking and proportionate supervisory framework. Given these considerations, a principle-based, case-by-case approach was assessed as more appropriate. This approach would enable the EBA to specify, when necessary, additional

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 32 activities to be included within the scope of ASUs. Furthermore, it would allow competent authorities to identify activities that should be considered similar and submit them to the EBA for assessment, thereby ensuring that supervisory convergence and a harmonised application across Member States are preserved. In light of the above, Option 5.b is considered the preferred policy option as it strikes an appropriate balance between legal certainty and flexibility, while ensuring a structured process to ensure consistent and convergent supervisory practices across Member States. 5.2. Feedback on the public consultation The EBA publicly consulted on the draft proposal contained in this paper. The consultation period lasted for 3 months and ended on 7 October 2025. 12 responses were received, of which 7 were published on the EBA website. This paper presents a summary of the key points and other comments arising from the consultation, the analysis and discussion triggered by these comments and the actions taken to address them where deemed necessary. In many cases several industry bodies made similar comments or the same body repeated its comments in the response to different questions. In such cases, the comments, and EBA analysis are included in the section of this paper where EBA considers them most appropriate. Changes to the Guidelines have been incorporated as a result of the responses received during the public consultation. Summary of key issues and the EBA’s response Definition of “banking” for the purposes of point (a) and (b) of Article 4(1)(18) of Regulation (EU) No 575/2013 Respondents raised concerns about the interpretation of “banking” and the breadth of the proposed criteria. They noted that Section 4.3 introduces a broader concept of “banking” than Section 4.2, which refers only to core banking services as referred to in points 1, 2 and 6 of Annex I to Directive 2013/36/EU. They argued that interpreting the same term differently within the same Regulation is inconsistent with legal principles and undermines regulatory simplification. A preference was expressed for the narrower interpretation in Section 4.2, which was considered more plausible and practical. The concept of “banking” as previously outlined in Section 4.3 of the Guidelines was meant to serve as a key reference point for determining which activities may qualify as ancillary to banking under Article 4(1)(18)(b) of Regulation (EU) No 575/2013. In the EBA’s view, the

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 33 purpose of these Guidelines is not to provide different interpretations of the term “banking”, but to clarify what constitutes a “direct extension of banking” or “ancillary to banking” under points (a) and (b) of Article 4(1)(18) of Regulation (EU) No 575/2013. The EBA considers that the approach taken in these Guidelines ensures consistency with the Level 1 text and reflects the differentiation of activities introduced by points (a) and (b) of Article 4(1)(18) of Regulation (EU) No 575/2013. The proposed approach is supported by the reference to (i) core banking services – identified in Recital 5 of Directive (EU) 2024/1619 – in the case of “direct extension of banking” activities, as these represent the direct extension of the main activities carried out by institutions, and to (ii) the list of activities laid down in Annexes to Directive 2013/36/EU and Directive 2014/65/EU, which provide a robust framework for identifying activities considered ancillary to those of institutions or financial institutions. Limited amendments have therefore been made to the Guidelines to clarify the terms that are specified herein. Criteria specified for identifying an activity as “a direct extension of banking” Overall, respondents suggested amendments to the list of activities laid down in paragraph 14 (now 13) of the Guidelines, noting that the concept of “fundamental to the value chain of core banking services” is vague and may lead to divergent interpretations. Regarding previous paragraph 13(b) of the Guidelines, the majority of respondents requested the exclusion of CIUs from this category, also highlighting a possible circular reference within the definition. Lastly, with respect to previous paragraph 13(c), the majority of respondents requested its deletion. In the EBA’s view, activities that are fundamental to the value chain of core banking services are those that, while not necessarily performed directly by institutions or financial institutions, are inherently financial in nature and essential to their day-to-day operations. As regards “other activities that are related to lending”, the EBA is aware that some undertakings performing crowdfunding services, peer-to-peer lending or marketplace lending may already fall under the definition of “financial institution” in Article 4(1)(26) of Regulation (EU) No 575/2013. While non-bank lenders qualify as “financial institutions” for the purposes of Regulation (EU) No 575/2013, digital platforms that intermediate or facilitate lending cannot be directly considered as performing a lending activity as listed in Annex I to Directive 2013/36/EU. Therefore, the EBA believes that such platforms should be captured under the “direct extension of banking” category, as they perform functions that are operationally and economically equivalent to core banking activities. These platforms facilitate credit intermediation, borrower-lender matching, and in some cases, risk assessment and servicing functions that are similar to those performed by institutions themselves. Amendments have been made to the criteria specifying “direct extension of banking” activities to remove “services and activities that involve maturity transformation, liquidity transformation, leverage or credit risk transfer” referred to in the previous of paragraph 13(b).

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 34 In addition, previous paragraph 13(c)has also been removed but “loan intermediation and distribution through innovative channels” has been added as a new “direct extension of banking” activity as laid down in point (c) of paragraph 14 (now 13(g)). Support, complement and rely on banking to identify activities as “ancillary to banking” Several respondents expressed concerns that the proposed criteria were too broad and suggested narrowing the scope to activities that directly support the institution’s banking business. In particular, respondents questioned the reliance criterion, especially in relation to funding, which they viewed as potentially capturing almost any entity receiving funding or services from an institution or financial institution of the group, irrespective of its actual business model, risk profile or principal nature of activity. Some respondents also requested further clarification on the “significance” criterion, seeking confirmation on whether the frequency or materiality of a service provided by an entity to a bank should influence its classification as an ASU. In addition, while respondents welcomed the limitation of the assessment to entities that are, or may be, included in the prudential consolidation perimeter, several respondents raised concerns about possible overreach and circular reasoning. They proposed deleting the reference to entities that may be included in the scope of consolidation to prevent disproportionate administrative burdens and avoid a situation where all participations could be deemed ASUs. Finally, some respondents opposed the specific provision applicable to companies jointly owned by IPS members, arguing that there is no justification for treating such companies differently from those jointly owned by non-IPS institutions. The EBA acknowledges some of the concerns raised by the industry. Nevertheless, it emphasises that the amendments introduced under Regulation (EU) 2024/1623 shift the focus towards assessing the intrinsic connection between an activity and banking – to determine whether the activity is “ancillary to banking” – rather than on the nature of the ancillary activity itself. In this context, the three criteria set out in the Guidelines are considered comprehensive, as they capture all relevant situations that demonstrate a meaningful connection to banking activities, while also allowing for the exclusion of activities that are not directly linked to banking, including taking into consideration the significance criterion. In this regard, the EBA stresses that the significance of the link should be assessed carefully to distinguish cases where the connection with banking activities is not sufficiently material or recurrent. In this respect, the funding criterion should also reflect the significance of the institution’s funding for the undertaking’s activities, recognising that certain activities, such as operational leasing or the ownership of property, may inherently exhibit a higher degree of funding reliance than others.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 35 Furthermore, the EBA notes that restricting the assessment to entities that have to, or may be, included in the consolidated prudential scope already serves to significantly limit the number of undertakings that need to be assessed as potential ASUs. The EBA further notes that undertakings for which capital ties are limited (e.g. entities that are not subsidiaries or participations of the institution) would also, in general circumstances, not be expected to meet the significance criterion. Finally, regarding the specific treatment of undertakings collectively owned by IPS members, the EBA has removed their explicit reference from the Guidelines, as such undertakings would in any case be covered under the general rule.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 36 Summary of responses to the consultation and the EBA’s analysis Comments Summary of responses received EBA analysis Amendments to the proposals Responses to questions in Consultation Paper EBA/CP/2025/11 Question 1. Do you have any comments on the general provisions set out in Section 4.1? In a general manner, one respondent argued that the Guidelines introduce several concepts that contradict the broader objective of reducing complexity in EU banking regulation. Another respondent questioned the link between “direct extension” and the list of activities laid down in Annex I to Directive 2013/36/EU. Regarding paragraph 12 of the Guidelines, the majority of respondents requested its removal, considering it inconsistent with the initiative to simplify banking requirements and difficult to apply in practice. In the same context, one respondent requested a transitional period of 12 months should the provision in paragraph 12 be retained. On the general treatment of collective investment undertakings (CIUs), one respondent suggested excluding CIUs from the scope of the Guidelines, arguing that The EBA is of the view that the concepts and processes set out in the Guidelines are necessary to ensure a risk￾sensitive, proportionate and harmonised supervisory framework for the identification of ASUs. The Guidelines aim to clarify and operationalise existing provisions under Article 4(1)(18) of Regulation (EU) No 575/2013, rather than introducing new regulatory burdens. The link between “direct extension of banking” and the list of activities laid down in Annex I to Directive 2013/36/EU is considered appropriate, as direct extension of banking activities are considered an extension of the core functions of institutions and therefore closely related to core banking services. Regarding paragraph 12, the EBA sees merits in retaining this provision, as it plays a key role in ensuring that undertakings performing ancillary activities are appropriately captured within the prudential perimeter. Removing it would risk undermining harmonisation and supervisory convergence in the qualification of the same undertaking as an ASU across institutions. A transitional period is not deemed necessary, as the current provision None.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 37 such exclusion would be consistent with previous EBA guidance. Finally, the clarification made in paragraph 11 has been welcomed by respondents. is considered consistent with the approach previously followed under the previous definition of “financial sector entities” under Article 4(1)(27) of Regulation (EU) No 575/2013. On the treatment of CIUs, the EBA takes note of the industry’s concern. However, the EBA is of the view that a general exclusion is not warranted, in line with previous stances on the treatment of CIUs. More generally, CIUs are normally not expected to qualify as financial institutions unless they perform one or more of the activities listed in Article 4(1)(26)(b)(ii) of Regulation (EU) No 575/2013 or fall under the ASU definition or, following the amendments introduced by Regulation (EU) 2024/1623, when regarded as ASU following the application of the provisions laid down in Regulation (EU) No 575/2013 and the criteria provided in these guidelines9 . The EBA also welcomes the positive feedback on paragraph 11, which was introduced to provide clarity on the undertakings that may qualify as ASUs. Question 2. Do you agree with the criteria specified for identifying an activity as a “direct extension Overall, respondents suggested amendments to the list of activities laid down in the previous paragraph 14 of the Guidelines, noting that the concept of “fundamental to the value chain of core In the EBA’s view, activities that are fundamental to the value chain of core banking services are those that, while not necessarily performed directly by institutions or financial institutions, are inherently financial in nature and essential to their day-to-day operations. Paragraph 13 has been deleted. Paragraph 14 (now 13) has been revised to include 9 The manner and extent to which CIUs should be included in the prudential scope of consolidation are determined by Article 11 and Article 18 of Regulation (EU) No 575/2013 and the criteria provided in the Commission Delegated Regulation (EU) 2022/676. Additional clarifications on the implementation of such provisions and interaction with the specific treatment set out in Articles 132 and 152 of Regulation (EU) No 575/2013 are provided in the Report on prudential consolidation.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 38 of banking”? Do you believe that other criteria should be included to identify activities that should fall under this definition? If yes, please provide detailed proposals banking services” is vague and may lead to divergent interpretations. Regarding point (b) of previous paragraph 13 of the Guidelines, the majority of respondents requested the exclusion of CIUs from this category, also highlighting a possible circular reference within the definition. Lastly, with respect to point (c) of the same paragraph, the majority of respondents requested its deletion. No additional criteria for inclusion were proposed by respondents. The EBA also takes note of the circular definition created by the reference to shadow banking entities for the purposes of Article 394(2) of Regulation (EU) No 575/2013. As regards “other activities that are related to lending”, the EBA is aware that some undertakings performing crowdfunding services, peer-to-peer lending or marketplace lending may already fall under the definition of “financial institution” in Article 4(1)(26) of Regulation (EU) No 575/2013. However, the EBA considers it essential to ensure that these types of undertakings are captured within the prudential scope of consolidation also even when they perform an activity not explicitly financial. In this regard, it should be recalled that while non-bank lenders qualify as “financial institutions” for the purposes of Regulation (EU) No 575/2013, digital platforms that intermediate or facilitate lending cannot be directly considered as performing a lending activity listed in Annex I to Directive 2013/36/EU. Therefore, the EBA believes that such platforms should be captured under the “direct extension of banking” category, as they perform functions that are operationally and economically equivalent to core banking activities. These platforms facilitate credit intermediation, borrower-lender matching, and in some cases, risk assessment and servicing functions that are similar to those performed by institutions themselves. The EBA is of the view that their inclusion ensures consistency an additional activity under point (g).

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 39 in prudential treatment and reflects the evolving structure of financial intermediation. Question 3. Do you consider appropriate the inclusion of services and activities that involve maturity transformation, liquidity transformation, leverage or credit risk transfer – when conducted by shadow banking entities – as one of the criteria for identifying activities that are a “direct extension of banking”? Some respondents requested that Collective Investment Undertakings (CIUs) be excluded from the scope of the activities listed in previous paragraph 13(b) of the Guidelines. Additionally, some respondents suggested replacing the reference to Article 394(2) of Regulation (EU) No 575/2013 with Article 4(1)(155) of the same Regulation. They noted that the current reference may result in a circular definition. The EBA acknowledges the concern raised regarding the reference to shadow banking entities for the purposes of Article 394(2) of Regulation (EU) No 575/2013, which is seen as circular in the context of identifying undertakings that perform services and activities that involve maturity transformation, liquidity transformation, leverage or credit risk transfer. Accordingly, previous paragraph 13(b) has been removed to ensure greater clarity and avoid circular reasoning, also noting that some of these activities should already be captured either by the “direct extension of banking” or the “ancillary to banking” criteria. In general, regarding the consideration of CIUs, the final guidelines remain consistent with the clarifications previously provided by the EBA10. According to the current framework and as an exception to the general rule, CIUs should be considered financial institutions only when carrying out one or more of the activities listed in Article 4(1)(26)(b)(i)11 of Regulation (EU) No 575/2013 as their principal activity, or, following the amendments introduced by Regulation (EU) 2024/1623, when regarded Previous paragraph 13(b) has been removed. 10 See EBA Q&A 2015_2383 and the Final report on RTS on methods of prudential consolidation. 11 In accordance with Article 4(1)(26)(b)(i) of Regulation (EU) No 575/2013, undertakings performing as their principal activity the acquisition or ownership of holdings, one or more of the activities listed in Annex I, points 2 to 12 and points 15, 16 and 17, to Directive 2013/36/EU, or one or more of the services or activities listed in Annex I, Section A or B, to Directive 2014/65/EU in relation to financial instruments listed in Annex I, Section C, to Directive 2014/65/EU, shall qualify as financial institutions provided that the criteria laid down in point (a) of that Article is complied with.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 40 as ASU following the application of the provisions laid down in Regulation (EU) No 575/2013 and the criteria provided in these guidelines12 . Question 4. Do you have any comments on the use of activities that are fundamental to the value chain of core banking services as a criterion for identifying activities that are a “direct extension of banking”? In particular, do you find the definition of and link to core banking services, and the related list of activities sufficiently clear? On the scope of application of paragraph 14 (now 13) of the Guidelines, some respondents requested limiting it to undertakings with a direct economic or ownership link. More generally, they stressed the importance of preserving the distinction between points (a) and (b) of Article 4(1)(18) of Regulation (EU) No 575/2013. The EBA considers that maintaining a differentiating scope between point (a) and (b) of Article 4(1)(18) of Regulation (EU) No 575/2013 is necessary to preserve the conceptual distinction between the two categories of ancillary services undertakings. Point (a) refers to undertakings that carry out activities which are a direct extension of banking. These activities are defined primarily by their intrinsic nature, as they replicate or substitute core banking services, regardless of whether the undertaking is part of the banking group. Their inclusion reflects the need to capture entities that perform banking-like functions and may pose prudential risks similar to those of institutions or financial institutions, even if those activities are not economically or operationally integrated into the banking group. In contrast, point (b) covers undertakings that carry out activities which are ancillary to banking. These activities are defined by their supporting, complementing or relying on roles in relation to institutions or financial institutions. Accordingly, the assessment under this category is limited to undertakings that have to or may have to be included in None. 12 The manner and extent to which CIUs should be included in the prudential scope of consolidation are determined by Article 11 and Article 18 of Regulation (EU) No 575/2013 and the criteria provided in the Commission Delegated Regulation (EU) 2022/676. Additional clarifications on the implementation of such provisions and interaction with the specific treatment set out in Articles 132 and 152 of Regulation (EU) No 575/2013 are provided in the Report on prudential consolidation.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 41 the scope of prudential consolidation, following their qualification as ASUs. This reflects their prudential relevance which arises from their relationship with the banking group, rather than the nature of their activities alone. Regarding the reference to core banking services, one respondent proposed removing point 6 of Annex I to Directive 2013/36/EU from the definition. As for the notion of being “fundamental to the value chain”, some respondents requested its deletion, arguing that the term is vague and open to interpretation. One respondent suggested removing the reference to “financial institutions” in paragraph 14 (now 13) of the Guidelines, noting that the recipients of those activities would likely be institutions. The reference to core banking services is aligned with Recital 5 of Directive (EU) 2024/2554, which provides a description of the services considered central to the functioning of credit institutions. This includes point 6 of Annex I to Directive 2013/36/EU, which refers to the provision of guarantees and commitments. The EBA is of the view that such reference should be kept, aligned with the approach taken within the Level 1 text. Regarding the notion of being “fundamental to the value chain of core banking services” the EBA has taken note of the concerns raised about its potential vagueness. To enhance clarity, the Guidelines have been amended to explicitly refer to the types of activities that constitute this notion. No further changes have been made, as the concept remains necessary to identify undertakings that perform functions closely linked to core banking services, even if not directly carried out by institutions or financial institutions. As for the request to remove “financial institutions” from paragraph 14 (now 13), the EBA considers its inclusion appropriate. While the recipients of the relevant activities may often be institutions, financial institutions of a Paragraph 14 (now 13) has been amended.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 42 banking group may benefit from the services provided by such undertakings. In the EBA’s view, removing this reference would risk excluding relevant undertakings that provide services to or in the interest of institutions or financial institutions. Concerning the list of activities laid down in paragraph 14 (now 13) of the Guidelines, some respondents requested the removal of activities listed under points (a), (c), (d), (f) or (g). Regarding point (a), one respondent argued that its inclusion goes beyond legislative intent. Respondents advocating for the deletion of points (a), (f) and (g) stated that these activities should fall under the “ancillary to banking” criterion rather than the “direct extension of banking” category, as they are not intrinsically financial but rather supportive in nature. For point (c), a clarification was requested to exclude rating agencies or credit scoring providers that provide services beyond institutions. Regarding point (d), its removal was requested due to concerns that it would encompass all forms of commerce involving The EBA considers it appropriate to retain the activity of brokerage of commercial or residential loans or deposits under paragraph 14(a) (now (13(a)) of the Guidelines. This activity involves the intermediation between clients and institutions or financial institutions for the purpose of facilitating core banking services – namely, lending and deposit-taking as referred to in Annex I, points 1 and 2, to Directive 2013/36/EU. While many brokers may not themselves perform these services, they play a critical role in the origination and distribution of banking products. Their functions are inherently financial and, if not performed by separate undertakings, would likely be carried out by institutions themselves. As such, their inclusion ensures consistency with the prudential consolidation framework, reflecting their fundamental role within the operations of core banking services. With reference to the credit worthiness assessment of individual clients of an institution or a financial institution under point (c), it should be noted that the wording in such point was drafted to exclude credit rating agencies, which typically provide rating for market purposes rather than assessing individual clients of institutions or financial Point (f) originally included in paragraph 14 (now 13) has been removed.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 43 debt recovery, which was considered overly broad. Finally, on point (g) one respondent asked for clarification that only acquisitions linked to non-performing loans strategies should qualify as direct extension of banking. institutions for lending, or other banking-related, decisions. This has been further clarified in the background section of the Guidelines to ensure that only undertakings supporting credit risk evaluation for clients as part of the course of the operations and business of institutions or financial institutions are captured. Regarding the removal of point (d), the EBA is of the view that debt recovery should be retained, as the wording “when mainly provided to, or in the interest of, institutions or financial institutions” ensures that only undertakings performing debt recovery services that are fundamental to core banking operations are captured. This formulation excludes undertakings engaged in general commercial debt recovery that are unrelated to institutions or financial institutions. The provision is intended to cover those that support the recovery of credit exposures of institutions or financial institutions, which is a key component of the credit lifecycle and closely linked to banking-specific risks. The EBA acknowledges the suggestion to delete point (f), which was considered more supportive in nature. In response, this point has been removed from the Guidelines. The EBA considers that such activity is more appropriately captured under the “ancillary to banking” criterion, when performed by undertakings that have to or may be included in the scope of prudential consolidation.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 44 Regarding point (g), the inclusion of “when mainly provided to, or in the interest of, institutions or financial institutions” is intended to ensure that the scope of direct extension of banking covers undertakings that acquire, own, manage or liquidate repossessed assets specifically as part of an institution’s non-performing loan strategy. The background of the Guidelines has been amended to reflect and clarify this point. Question 5. Do you consider appropriate the inclusion of “other activities related to lending” as one of the criteria to identify activities that are a “direct extension of banking”? Do you consider undertakings that perform one of these activities as their principal activity already qualifying as financial institutions within the meaning of Article 4(1)(26) of The majority of respondents requested the removal of this category from the definition of “direct extension of banking”, considering it vague and introducing an unnecessary layer of uncertainty. Some respondents noted that certain undertakings performing one of these activities may already qualify as financial institutions, while others could fall under the activities identified as fundamental to the value chain of core banking services. The category of “other activities related to lending” has been removed from the definition of “direct extension of banking” to take reflect the concerns raised by the industry. However, the EBA considers it essential to preserve the recognition of certain activities – particularly those performed by platforms offering crowdfunding, peer-to￾peer, or marketplace lending services – as they play a meaningful role in the lending landscape. These undertakings contribute to the origination, intermediation, and distribution of loans, through innovative channels that expand the traditional banking models. To reflect this, a new category under “activities fundamental to the value chain of core banking services” has been introduced, specifically covering loan intermediation and distribution through innovative channels. This change is meant to capture those platforms that are not already qualifying as institutions or financial institutions but still warrant consideration due to Previous paragraph 13(c) has been removed. Paragraph 14 (now 13) has been revised to include an additional activity under point (g).

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 45 Regulation (EU) No 575/2013? performing activities that should be considered a direct extension of core banking services. Question 6. Do you agree with the proposed criteria for identifying activities that are “ancillary to banking”? Are the three main criteria specified for that purpose (i.e. support, complement and rely on banking) sufficiently clear? Are there any other criteria that should be included in that regard? In general terms, respondents requested clarification on whether the frequency and significance of services provided to an institution or a financial institution should affect the classification as an ASU. Some asked for clearer guidance on the consideration of one-time or ongoing services, and whether the activity’s relevance within the undertaking’s overall operations should be considered. Many respondents emphasised that only entities with material relevance to the group’s risk profile should be included, suggesting closer alignment between prudential and accounting consolidation using materiality as a threshold. Further, many respondents recommended excluding administrative support, human resources, and document management from the scope, as these are not economically linked to banking risks. Additional exclusions proposed included entities that merely receive funding or services from an institution (e.g. pension The EBA is of the view that the Guidelines already adequately address the dimension of frequency and significance of services provided to an institution or a financial institution for the purpose of classification as an ASU. They specifically refer, for example, to the “relevance of the link or connection of the activity”. Moreover, in assessing the reliance criterion, a “significant” dependence on banking products and services, including funding, is required. Therefore, the Guidelines are designed to capture only those relationships and links that are significant, thereby allowing a proportionate implementation. Regarding administrative support, human resources support, and similar activities, the EBA considers that – when performed by undertakings belonging to the same group – these activities support banking operations and, as such, should be considered ASUs and captured within the prudential consolidation perimeter. Excluding such undertakings could create opportunities for arbitrage whereby institutions might allocate their assets (e.g. intangibles) to non-consolidated undertakings to avoid unfavourable capital treatments (e.g. capital deduction). Concerning the proposed list of undertakings to be excluded, the EBA reiterates that the assessment of whether an activity is ancillary to banking should only be None.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 46 funds, charitable organisations), CIUs and insurance brokers. performed for undertakings that would be or could be consolidated under Article 18 of Regulation (EU) No 575/2013, when qualifying as an ASU. Only in such cases may the link and connection with banking arise, in line with the criteria provided in the Guidelines for the ancillary test (i.e. support, complement and reliance). The mere provision of funding or services to those undertakings is not considered sufficient to qualify them as an ASU if they are not, or cannot be, included in the consolidated situation in accordance with Article 18 of Regulation (EU) No 575/2013. Support Most respondents agreed that the “supporting” attribute is reasonable. However, some respondents considered the examples too broad and suggested narrowing the scope to clear outsourcing cases. One respondent disagreed with the “support” and “reliance” criteria, proposing to retain only “complement banking” as a valid criterion. Several respondents stressed that “ancillary” should be limited to activities that directly support or facilitate banking, warning that a broad interpretation would go beyond the purpose of prudential The EBA is of the view that the support criterion ensures that undertakings performing activities which enhance, enable, or facilitate the conduct of banking business are captured within the prudential scope of consolidation. The examples provided are considered typical cases of supporting and/or facilitating banking. In this regard, it should be noted that this criterion should be assessed only for undertakings that, when qualifying as ASU, would or might be prudentially consolidated under Article 18 of Regulation (EU) No 575/2013 and the Regulation (EU) 2022/676. The EBA considers that this approach ensures that the qualification as an ASU is restricted only to those entities with a close and direct link to banking activities (i.e. undertakings not part of the group should not be assessed against the criterion). None.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 47 consolidation, which should focus on entities with a close and direct link to banking activities. Complement The criteria of “complementing” were seen as potentially too broad by respondents, as it could cover unrelated activities such as cross-selling or customer acquisition, which do not inherently pose banking-specific risks. The concept of “ancillary services undertaking” in Article 4(1)(18) of Regulation (EU) No 575/2013 has evolved under Regulation (EU) 2024/1623. Previously, the concept referred broadly to entities ancillary to the activities of one or more institutions. The revised definition now places greater emphasis on the existence of (economic, operational or financial) links and connections with the banking business (i.e. being “ancillary to banking”). Under the new framework, it is not the nature of the activity itself that determines whether an undertaking is ancillary, but rather the characteristics of its operations. Activities that are not strictly financial may still qualify if they are economically, operationally, or financially integral or functional to the conduct of banking business. In this context, the “complementing” criterion is designed to capture cases where an undertaking’s activities are commercially and operationally integrated with those of an institution or financial institution of the group – particularly, through shared distribution or marketing channels. This integration may manifest in two ways: (a) the undertaking enables the institution/financial institution to expand the offer of its financial products to the undertaking’s customers or (b) the undertaking leverages on the institution/financial institution’s None.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 48 customer base to distribute its own non-banking products and services. In both scenarios, the undertaking’s operations are economically and operationally embedded in the banking business and contribute to its effective conduct and risk profile. As such, these undertakings should be considered ancillary to banking. In terms of scope of application, the EBA considers that the application of this criterion does not imply an indiscriminate broadening of the ASU designation. It applies exclusively to undertakings that, when qualifying as ASU, are or might be prudentially consolidated. This approach ensures that the qualification as an ASU is limited to those entities subject to prudential consolidation in accordance with Article 18 of Regulation (EU) No 575/2013 and the Regulation (EU) 2022/676. Undertakings outside of the group should not be assessed against the criterion. Relies Respondents noted that the “relying on banking” criterion could be problematic, as it could capture any entity receiving funding or services from an institution, regardless of its business model or risk profile. Concerns were raised about the lack of alignment with the Level 1 text emphasis on the principal activity of the undertaking. As mentioned above, the concept of “ancillary services undertaking” has evolved under Regulation (EU) 2024/1623. The updated definition shifts the focus to the economic, operational or functional characteristics of an undertaking’s operations, that may be integral or functional to the conduct of banking business, even if not strictly financial in nature. In this context, a relevant reliance on an institution or financial institution’s services and funding denotes that an undertaking’s activity is functionally and economically Paragraph 23a (now 21(a)) has been amended to reflect operational and personnel dependencies.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 49 One respondent suggested excluding equity capital from the definition of “funding”, while another proposed considering operational and personnel dependencies as part of the reliance assessment. embedded within the banking group’s business model. The EBA is of the view that the reliance criterion introduced in these Guidelines is not only consistent with the Level 1 text but also serves as a key indicator for identifying undertakings that are ancillary to banking. It reflects both the functional connection to the banking group and the prudential relevance of the undertaking’s risks, which should be appropriately captured at the consolidated level. Moreover, it provides a practical and meaningful criterion to distinguish undertakings that are genuinely ancillary to banking from those held primarily for investment purposes. While certain activities (such as real estate or operational leasing) are not per se ancillary, they may qualify as such when they are demonstrably integral or functional to the banking business. The EBA has also noted that without the reliance on funding criterion the relevant businesses listed in Article 4(1)(18) of Regulation (EU) No 575/2013 (e.g. operational leasing) would not qualify as ASU in most circumstances, contrary to the spirit and objectives of Regulation (EU) 2024/1623 amendments. Conversely, introducing alternative criteria based solely on the nature of the business may result in indiscriminately qualifying all such activities as ASUs. In this context, the funding criterion serves as a key differentiator between undertakings considered ancillary

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 50 and those held primarily for investment purposes. Specifically, where an undertaking operates without a link to banking activities - such as financing its operations mainly through the market - it would not qualify as an ASU and would instead be treated as a pure investment, outside the scope of prudential consolidation. Nonetheless, additional clarifications have been included in the background section to specify how the assessment of the relevant link and connection of the activity to that of an institution or financial institution should be performed, in particular with regard to activities not explicitly listed in Article 4(1)(18) of Regulation (EU) No 575/2013. It is also worth noting that, based on a recent EBA survey on prudential consolidation practices, many institutions have been using this criterion. Therefore, in the EBA’s view, this criterion is not expected to materially impact the classification of ASUs for the majority of institutions, as these activities were already treated as ancillary to banking under existing internal criteria. Importantly, the criterion should be assessed for undertakings that are part of the banking group. This ensures that the ASU qualification remains limited to entities subject to being included in prudential consolidation in accordance with Article 18 of Regulation (EU) No 575/2013 and the Regulation (EU) 2022/676. Undertakings that rely on banking but that are not part of the group should not be assessed against this criterion.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 51 Regarding the distinction between different forms of funding – specifically the exclusion of equity – the EBA does not see merit in introducing differentiated treatment in these Guidelines. The EBA considers that such a distinction could facilitate regulatory arbitrage, as the form of funding (e.g. equity vs. intragroup loans) may be economically irrelevant for an institution or financial institution, particularly when provided to fully owned (subsidiary) undertakings. On the consideration of operational and personnel dependencies as part of the reliance assessment, the EBA considers these aspects to be already encompassed within the broader concept of reliance on “banking products or services”. To enhance clarity, the Guidelines have been updated accordingly. Question 7. Do you agree with the approach envisaged in Section 4.3, which limits the assessment of an activity as “ancillary to banking” only to undertakings that have to or may have to be included in the scope of Respondents generally supported the proposal to limit the assessment of “ancillary to banking” activities to undertakings that must be included in the scope of prudential consolidation. This approach was welcomed as a means to reduce unnecessary burden and support regulatory simplification. Respondents expressed concern about circular reasoning in paragraph 18(a) (now 16(a)) of the Guidelines, which refers to companies that “have to or may be included The reference in paragraph 18(a) (now 16(a)) of the Guidelines, which refers to companies that “have to or may be included in the prudential perimeter of consolidation of the institution”, is meant to define the scope of the ancillary assessment. According to the Guidelines, this assessment should be performed for undertakings that when qualifying as ASUs: None.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 52 prudential consolidation or are collectively held by institutions belonging to the same IPS? in the prudential perimeter of consolidation of the institution”. They stressed that this could lead to all participations in relevant companies – or those covered by Article 19 of Regulation (EU) No 575/2013 – being classified as ASUs based on a theoretical possibility of inclusion. To avoid disproportionate administrative burdens, they proposed deleting the reference to “or may”. Additionally, a clarification was requested to confirm that institutions not required to perform prudential consolidation of subsidiaries or participations are also not required to assess the ASU status of undertakings in which they only hold a participation. i. would be “automatically” prudentially consolidated under Article 18 of Regulation (EU) No 575/201313; ii. may be required to be consolidated upon request of a competent authority14 in accordance with the Regulation (EU) 2022/676; iii. would qualify as a “financial holding company” under Article 4(1)(20) of Regulation (EU) No 575/2013, or count towards the indicators laid down therein for the purposes of assessing an FHC. With regard to undertakings exempted from consolidation under Article 19 of Regulation (EU) No 575/2013, it should be noted that their exclusion should not alter their regulatory classification. Therefore, if such undertakings meet the criteria set out in Article 4(1)(18) of Regulation (EU) No 575/2013 and in these Guidelines, they should still be considered ASUs and subject to the FSE deduction regime in accordance with Article 36(1)(h) and (i) of Regulation (EU) No 575/2013. With regard to undertakings that are held by an institution not required to perform consolidation, it has to be noted 13 These are the cases of institutions and financial institutions that are subsidiaries, and participations in institutions and financial institutions that are jointly controlled as referred to in paragraphs 1, 3 and 4 of Article 18 of Regulation (EU) No 575/2013, respectively. 14 This refers to cases of undertakings related within the meaning of Article 22(7) of Directive 2013/34/EU, institutions or financial institutions placed under single management other than pursuant to a contract, clauses of their memoranda or articles of association, and cases of significant influence and step-in risk as laid down in paragraphs 5, 6(a) and 6(b) of Article 18 of Regulation (EU) No 575/2013. The inclusion and method of consolidation of those undertakings is determined in accordance with the RTS on method of prudential consolidation.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 53 that in those cases the qualification as ASU should be consistent with the qualification performed by the ultimate parent subject to consolidation. In accordance with the general principle stated in paragraph 12 of these Guidelines, if the undertaking qualifies as an ASU for another institution (including the ultimate parent institution in a Member State) it should qualify also as ASU for any other undertaking – relevant, for example, for the application of the FSEs deduction regime. Finally, the criteria outlined in these Guidelines are also valid for assessing whether an undertaking in which an institution holds a participation qualifies as an ASU. In particular, such participations may need to be consolidated under Article 18 of Regulation (EU) No 575/2013 and the RTS on methods of consolidation, where step-in risk is identified - thus falling within the scope of the assessment defined by these Guidelines. This proposed treatment aligns with the broader assessment required for other holdings in institutions or financial institutions, which includes cases where the institution holds participations or other capital ties. Nonetheless, the EBA recognises that in instances of non-material participations or capital ties, the undertaking in question may not always meet the criteria set out in the Guidelines for ASU qualification, due to the possible absence of a meaningful link or connection to banking. These Guidelines are therefore considered to provide sufficient leeway to exclude “irrelevant” (i.e. with no relevant link or

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 54 connection with banking) undertakings from the qualification of ASU. Many respondents suggested removing the special provisions for companies jointly owned by Institutional Protection Scheme (IPS) members. They argued that there is no justification for treating these undertakings differently from those owned by non-IPS institutions. Respondents also noted that joint holdings within IPS structures are typically of limited financial significance and held for collective strategic purposes, making stricter rules unwarranted. Finally, some respondents requested a clearer definition of “collectively owned”, noting that the term is ambiguous – particularly regarding whether collective ownership implies control or significant influence. The EBA acknowledges that the provision concerning undertakings collectively owned by IPS members is not warranted, noting that the scope of application designed for the ancillary assessment, in line with Article 18(5) of Regulation (EU) No 575/2013, already allows for capturing those undertakings in which IPS members hold a direct or indirect participation or other capital ties. These considerations are particularly relevant to ensure that at the level of the IPS member such holdings are subject to the FSEs deduction regime under Article 36 of Regulation (EU) No 575/2013. Formerly included paragraph 18(b) has been removed from the Guidelines. Question 8. Do you have any comments on the concept of “banking” specified in Section 4.3, which includes all relevant services or activities provided Respondents raised concerns about the interpretation of “banking” and the breadth of the proposed criteria. Respondents noted that Section 4.3 introduces a broader concept of “banking” than Section 4.2, which refers only to points 1, 2 and 6 of Annex I to Directive 2013/36/EU. The concept of “banking” as previously outlined in Section 4.3 of the Guidelines served as a key reference point for determining which activities may qualify as ancillary to banking under Article 4(1)(18)(b) of Regulation (EU) No 575/2013. The purpose of these Guidelines is not to provide different interpretations of the term “banking”, but to clarify what constitutes a “direct extension of banking” Paragraph 16 (now 15) has been amended. A revised paragraph 16(b) has been introduced.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 55 by institutions or financial institutions? They argued that interpreting the same term differently within the same Regulation is inconsistent with legal principles and undermines regulatory simplification. A preference was expressed for the narrower interpretation in Section 4.2, which was considered more plausible and practical. One respondent proposed defining banking activities as those involving maturity transformation, liquidity transformation, leverage, or credit risk transfer. Respondents further highlighted that interpreting “ancillary” so broadly would include activities unrelated to banking risks (e.g. tire-changing for leased cars). Two respondents recommended excluding the investment services and activities, and the ancillary services listed in Annex I, Sections A and B, to Directive 2014/65/EU from the definition, as these are subject to separate prudential frameworks. They noted that the proposed Guidelines could capture activities that merely supplement or rely on the ancillary services listed in Annex I, Section B, to Directive 2014/65/EU, which are themselves ancillary to investment or “ancillary to banking” under points (a) and (b) of Article 4(1)(18) of Regulation (EU) No 575/2013. In this context, the Guidelines specify that an activity should be considered “ancillary to banking” when it either supports, complements or relies on the provision of the services or activities typically carried out by institutions or financial institutions. The list of such services and activities is thus aligned with points (3) and (26) of Article 4(1) of Regulation (EU) No 575/2013. This approach ensures consistency with the Level 1 provisions and is supported by reference to the list of activities laid down in Annexes to Directive 2013/36/EU and Directive 2014/65/EU, which offer a robust framework for specifying relevant activities. With regard to investment services and activities, and the ancillary services listed in Annex I, Sections A and B, to Directive 2014/65/EU, the EBA highlights the different objectives pursued under Regulation (EU) No 575/2013 and Directive 2014/65/EU. Ancillary services under Directive 2014/65/EU are financial in nature – such as the granting of credit or loan – and are intended to define the scope of authorised activities that investment firms may carry out beyond their core investment services and activities. By contrast, the concept of “ancillary services undertaking” under Regulation (EU) No 575/2013 encompasses a broader range of activities – including, for example, the provision of data processing services. Its

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 56 services, creating confusion with Article 4(1)(1) of Regulation (EU) 2019/2033. primary purpose is to determine which undertakings should be included within the prudential scope of consolidation. The EBA is of the view that, given the distinct objectives pursued by both frameworks, no amendments to the Guidelines are necessary. The EBA acknowledges that, in limited cases, setting any criteria in the Guidelines may risk capturing undertakings that are not particularly relevant for consolidation purposes. However, the EBA is of the view that “ancillary to banking” should not be interpreted as narrowly as activities exposing institutions to traditional banking risks. Other types of risks – such as potential double gearing, operational dependencies or potential financial support in case of distress – are also relevant to the consolidated situation of an institution or (mixed) FHC. To mitigate this risk, the Guidelines together with the Level 1 text include several safeguards: (i) the ancillary to banking assessment applies only to undertakings that, if classified as ASUs, would or might be subject to prudential consolidation under Article 18 of Regulation (EU) No 575/2013 and the Regulation (EU) 2022/676; (ii) the assessment should take into account the relevance of the link between the undertaking’s activity and banking – i.e. support, complement or rely criteria – providing flexibility to exclude undertakings lacking such a connection; (iii) in case of prudential consolidation of undertakings that are not relevant for supervision, Article

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 57 19 of Regulation (EU) No 575/2013 provides the option for competent authorities to exempt such undertakings. All in all, the EBA is of the view that the current prudential consolidation framework allows for capturing only undertakings of prudential relevance, avoiding unnecessary burdens and promoting proportionate and prudentially meaningful outcomes. Question 9. Do you have any comments on the specifications provided for the activities explicitly referred to in Article 4(1)(18)(b) of Regulation (EU) No 575/2013? In particular, are the illustrative examples provided therein adequately defined? Respondents provided detailed comments on the interpretation of operational leasing, the ownership or management of property, data processing services, and the criteria for identifying ASUs, with particular concern about overly broad definitions and the cumulative application of criteria. With reference to the latter, several respondents requested clarification on whether the criteria in paragraphs 16 to 23 (now 15 to 21) apply cumulatively with those in paragraphs 24 to 27 (now 22 to 25). They expressed support for the cumulative application to ensure that only undertakings genuinely ancillary to banking are captured. A suggestion was made to clarify the phrase “notwithstanding the general criteria provided in paragraphs 16 to 23”. The EBA acknowledges the concerns raised by the industry and has amended the Guidelines to clarify that paragraphs 24 to 27 (now 22 to 25) of Section 4.3 are intended to illustrate the application of the general criteria provided in paragraphs 16 to 23 (now 15 to 21). Paragraphs 25 to 26 (now 22 to 25) have been amended. Operational leasing The EBA considers that limiting the “ancillary to banking” designation for operational leasing undertakings only None.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 58 Respondents argued that operational leasing should only be considered ancillary when it directly supports banking operations (e.g. leasing premises for the institution’s use). They expressed their concerns about including all leasing activities, especially those unrelated to banking, as this would blur the boundary between banking-related and commercial activities. Some recommended aligning the definition of operational leasing with IFRS. Specific exclusions were proposed for short-term rental businesses, which do not generate comparable risks. Concerns were also raised that specialised lending exposures – intended to benefit from favourable risk-weight treatment under Article 122a(1) of Regulation (EU) No 575/2013 – could instead be subject to stricter financial sector entity treatment under the Guidelines. when their business directly supports banking operations (e.g. leasing premises for the institution’s use), would disregard relevant dimensions of the assessment. The complementing and reliance criteria are considered relevant for assessing whether operational leasing is ancillary to banking, since they allow for distinguishing cases where the investment represents holdings with mere commercial intent to those of a genuine ancillary nature. In the EBA’s view, the aim of the Guidelines is not to indiscriminately classify all operational leasing activities as ancillary, but only those where a meaningful connection or link to banking exists. It is worth reiterating that the “ancillary to banking” assessment applies only to undertakings which, if classified as ASUs, would or might be subject to consolidation under Article 18 of Regulation (EU) No 575/2013 and the Regulation (EU) 2022/676. This requirement inherently limits the scope of application to situations relevant for the prudential consolidation framework. For this reason, the EBA considers that the qualification of an undertaking as an ASU is not expected to interfere with the treatment of specialised lending exposures, as undertakings financed under such arrangements typically do not belong to the banking group.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 59 With regard to short-term rental businesses, the EBA does not consider it appropriate to introduce a specific differentiation in the Guidelines. The ancillary assessment should be based on the existence of a functional link or connection to banking, rather than the nature of the activity itself. Ownership or management of property Respondents generally agreed that only the ownership or management of property used to support banking should be considered ancillary. They suggested not considering those undertakings that own or manage properties for non-banking purposes, or where the recipient of the services is a third party (e.g. customer), as these do not present banking￾specific risks. Clarifications were requested to ensure that: (i) the mere ownership of foreclosed assets does not meet the ancillary criteria; (ii) paragraph 26(a)(ii) (now 24(a)(ii)) of the Guidelines refers specifically to realised collateral of non-performing loans managed by the undertaking, and not to cases where a customer owns a property financed by the institution; and (iii) the property owner is clearly defined – e.g. “the institution’s The EBA takes note of the concerns regarding the scope of ownership or management of property activities qualifying as ancillary to banking. However, it does not consider it appropriate to restrict the qualification as ASUs solely to cases where property ownership or management directly supports banking operations. Such a limitation would overlook situations where property-related activities are economically or operationally embedded in the banking business, particularly when assessed against the complementing and reliance criteria. The exclusion of undertakings that own or manage properties for non-banking purposes – or where the recipient of the services is a third party (e.g. customer) – is not considered consistent with the spirit of the ancillary assessment or the criteria set out in the Guidelines. The ancillary assessment should not be based on the nature of the activity alone, but on the existence of a functional link or connection to banking. The EBA considers that the Guidelines already provide sufficient clarity on the points of further clarification raised. However, the following is noted: Paragraph 26(a) (now 24(a)) has been amended.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 60 ownership of the properties arises as a direct result of banking business”.

• The ownership of foreclosed assets should be considered an activity qualifying as “direct extension of banking” under paragraph 14(g) (now 13(f)) of the Guidelines. Such activities may also meet the ancillary criteria under paragraph 26(a)(ii) (now 24(a)(ii)) of the Guidelines. In this regard, it is reiterated that the ASU qualification is based on a holistic assessment, and multiple criteria can be met simultaneously.
• In paragraph 26(a)(ii) (now 24(a)(ii)), the property ownership refers to the undertaking which is subject to the ancillary assessment. Data processing services Some respondents stated that only data processing services linked to banking￾specific risks (e.g. core banking risks, KYC, credit application tools) should be considered ancillary. Generic services such as human resources applications or data warehouses, which can be used by any company, should be excluded. The EBA does not consider it appropriate to limit the ancillary assessment only to services linked to “banking￾specific” risks. First, it is again stressed that, according to the new ASU definition, an undertaking’s ancillary nature is no longer determined exclusively by the type of activity it performs, but rather by its function, operational characteristics and degree of interconnectedness with the banking business. Therefore, as clarified in the Guidelines, an activity may be considered ancillary to banking if it supports, complements or relies on banking. Excluding undertakings based on their nature or type of risks involved could create opportunities for regulatory arbitrage whereby institutions might allocate assets (e.g. intangibles) to non-consolidated undertakings to avoid unfavourable capital treatments (e.g. capital deduction). In this context, the EBA is of the view that the current None.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 61 approach is proportionate and risk-sensitive, and does not see merit in introducing exclusions for generic services. Question 10. Do you have any comments on the process envisaged for the determination of activities to be considered similar to points (a) and (b) under Article 4(1)(18)(c) of Regulation (EU) No 575/2013? One respondent requested the removal of the process, suggesting that if retained, a transitional period should be granted to institutions. They also noted that the current wording implies that the competent authority – rather than the institution – would be responsible for determining whether an undertaking qualifies as an ASU. Together with another respondent, they raised concerns about the lack of clarity in the procedure. Finally, another respondent argued that the guidelines should provide a clear definition and not a process. The EBA is of the view that a process – rather than a fixed definition – for the identification of activities that may be considered similar to points (a) and (b) is necessary to maintain flexibility and supervisory convergence. Removing this process would limit the ability of the Guidelines to adapt to emerging sources of risk and evolving business models, particularly in the current dynamic landscape. This could result in relevant undertakings being excluded from the scope of ASUs, thereby undermining the effectiveness of the prudential framework. In response to the concerns about clarity, additional explanations have been provided in the background section of the Guidelines. The mechanism is designed to operate on a case-by-case basis and does not impose immediate changes on institutions. Therefore, the EBA does not consider a transitional period necessary. It is also important to note that the competent authority is not responsible for determining whether an undertaking qualifies as an ASU. Rather, its role is to flag cases to the EBA where specific activities may not be captured by the current Guidelines but may warrant inclusion. The background section has been amended to clarify that, in cases where an institution identifies such activities, it should report them to its competent authority, which will None.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 62 then inform the EBA. The final decision will rest with the EBA, in accordance with Article 4(1)(18)(c) of Regulation (EU) No 575/2013, ensuring consistency and convergence across Member States. Question 11. Do you have any comments on the clarification of the principal activity of an ASU? Do you consider the definition of this concept useful for the application of Article 4(1)(18) of Regulation (EU) No 575/2013? One respondent requested the deletion of the supervisory power granted to competent authorities. Two respondents argued that the assessment of the activities should be based individually and not on a cumulative basis. One of these respondents further suggested allowing undertakings to define their own criteria for determining their principal activity, using the indicators set out by the EBA only where data is available. In addition, they proposed that the principal activity of an undertaking should be established when two indicators are met, rather than only one. Finally, another respondent welcomed the clarification, noting that it provides the necessary clarity and contributes to a harmonised approach. In the EBA’s view, it is essential to retain the process for determining the principal activity of an ancillary services undertaking, as set out in the Guidelines. This process ensures a consistent and risk-sensitive approach across Member States, particularly in cases where undertakings engage in multiple activities that may individually fall below the thresholds but collectively represent a significant link to banking. A cumulative assessment is therefore necessary to avoid underestimating the overall risk exposure and to maintain alignment within the prudential perimeter. The Guidelines also provide flexibility by allowing for a case-by-case determination of principal activity where thresholds are not met, as clarified in paragraph 31 (now 29) of the background section. Such an approach would be relevant where the necessary information for calculating the thresholds cannot be obtained, or where the thresholds are not triggered. This ensures proportionality and accommodates complex or evolving business models, including cases where data may not be readily accessible, while maintaining supervisory oversight. None.

FINAL REPORT ON GUIDELINES ON ANCILLARY SERVICES UNDERTAKINGS 63 Regarding the role of competent authorities, the EBA considers that the Guidelines do not grant them unilateral powers to determine the qualification as an ASU. No changes are therefore proposed to the current approach. The process has been further clarified in the background section of the Guidelines. Question 12. In general, is there any other activity or criteria not explicitly mentioned in these guidelines that should be considered to identify activities as either a “direct extension of banking” or “ancillary to banking”? Respondents did not identify any additional relevant activities or criteria beyond those already included in the Guidelines. At this stage, the EBA does not consider any further criteria necessary to identify activities as either a “direct extension of banking” or “ancillary to banking”. None.