GFSC Guidance Note on Change of Control: Assessment of Acquisitions and Increases in Control

Version: 1 Publication Date: 1 June 2026 GFSC Guidance Note Change of Control: Assessment of Acquisitions and Increases in Control www.gfsc.gi

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 2 Contents

1. Introduction.............................................................................................................................. 3
2. Controller concepts and identification ....................................................................................... 4 Decision to acquire or increase control.................................................................................................... 4 Significant influence ................................................................................................................................. 5 Aggregation of holdings (including acting in concert).............................................................................. 6 Indirect controllers................................................................................................................................... 9
3. Notice of proposed acquisitions and increases in control.......................................................... 10 Submitting the notification (including pre-notification engagement)................................................... 10 Information requirements – varying or waiving..................................................................................... 13 Forms to be submitted for multiple entities controlled by the same person........................................ 13 Completeness of the notification........................................................................................................... 13 Ministerial consent for credit institutions.............................................................................................. 14 GFSC’s Notification Expectations of Gibraltar Regulated Firms............................................................. 15
4. Assessment of the proposed acquisition .................................................................................. 16 The GFSC’s approach.............................................................................................................................. 16 The reputation of the proposed controller............................................................................................ 17 The reputation, knowledge, skills and experience of those who will direct the business of the Gibraltar regulated firm as a result of the proposed acquisition .......................................................................... 22 The financial soundness of the proposed controller.............................................................................. 22 Whether the Gibraltar regulated firm will be able to comply with its prudential requirements and threshold conditions............................................................................................................................... 24 Whether there are reasonable grounds to suspect that in connection with the proposed acquisition (i) money laundering, terrorist financing or proliferation financing is being or has been committed or attempted or (ii) the risk of such activity could increase....................................................................... 25
5. GFSC’s approach to the use of conditional approvals to advance its regulatory objectives......... 27 Annex 1 – Practical examples of the determination of controllers..................................................... 28 Annex 2 – Further guidance on acting in concert and deemed voting power ..................................... 34

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 3

1. Introduction 1.1. This Guidance Note is relevant to all Gibraltar regulated firms and, in particular, to persons to which the change of control requirements set out in Part 9 of the Financial Services Act 2019 (the ‘FSA’) apply. It sets out the expectations of the Gibraltar Financial Services Commission (‘GFSC’) in relation to: • how to identify controllers, including the concepts of significant influence, aggregated holdings and indirect controllers (see section 2 below); • submitting a section 111 notice1 and the approach to completeness (see section 3 below); • the GFSC’s notification expectations of Gibraltar regulated firms (see section 3 below); • the assessment criteria (in accordance with s119 of the FSA) used to assess notifications to acquire or increase control over a Gibraltar regulated firm (see section 4 below); and • how the GFSC will use its statutory power to impose conditions on an approval when it advances any of its regulatory objectives (see section 5 below). 1.2. This Guidance Note includes brief references to the requirements relating to reducing or ceasing to have control, as set out in section 116 of the FSA. A person who decides to reduce or cease to have control over a Gibraltar-regulated firm must give the GFSC notice before making the disposition, in accordance with sections 127 and 128 of the FSA. Further information on reducing or ceasing control is available on the GFSC’s webpage. 1.3. The information contained in this Guidance Note, including the illustrative diagrams in Annex 1, indicates how the GFSC may expect Gibraltar regulated firms and those acquiring or increasing control over a Gibraltar regulated firm to identify ‘controllers’ for the purposes of the FSA. The illustrative guidance offered is not exhaustive, particularly in relation to broad concepts such as ‘acting in concert’. There may be cases where it is necessary for the GFSC to take an approach that is not described in this guidance. 1.4. This Guidance Note is intended to complement existing legislation, policies and guidance and is not intended to conflict with, amend or supersede them unless otherwise stated. 1.5. This Guidance Note replaces the Joint Guidelines on the prudential assessment of acquisitions and increases of qualifying holdings in the financial sector which applied from the 1 October 2017 published by the Joint Committee of the European Supervisory Authorities. It should be read in conjunction with the legislative provisions set out in: • Part 9 and s131(3) of the FSA; • s276 of, and Schedule 20 to, the Companies Act 2014; and • relevant and applicable sector-specific regulations including but not limited to the: o Financial Services (Investment Services) Regulations 2020; and o Financial Services (Credit Institutions and Capital Requirements) Regulations 2020. 1 This includes the change of control notification form, supporting documents and additional information.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 4 2. Controller concepts and identification 2.1. This section sets out the GFSC’s expectations as to how the following concepts should be interpreted: a) decision to acquire or increase control2 ; b) significant influence3 ; c) aggregation of holdings (including acting in concert4 ); and d) indirect controllers (including limited partnerships and minority controllers and their parents). 2.2. All the above concepts have an impact on whether a person would be deemed to be a controller as part of a proposed acquisition and/or an increase in control. Decision to acquire or increase control 2.3. S111(1) of the FSA requires a person who decides to acquire or increase control over a Gibraltar regulated firm to give the GFSC notice before making the acquisition. The GFSC’s expectations for submitting a section 111 notice are set out in section 3 of this Guidance Note. 2.4. The GFSC expects the following non-exhaustive list of elements to be relevant to an assessment as to whether or not a decision to acquire or increase control over a Gibraltar regulated firm has been made: a) whether the proposed controller was aware of or, considering information it could have had access to, should have been aware of the acquisition or the increase of control and the transaction giving rise to it; and b) whether the proposed controller had the ability to influence, object to or prevent the proposed acquisition or increase of control. 2.5. The GFSC expects there to be a finding of a decision to acquire in most circumstances, as almost always the controller will have taken, or omitted to take, certain actions which will have contributed to the circumstances leading to a threshold being crossed under s115 of the FSA or a holding being acquired under s114 of the FSA. The GFSC will therefore adopt a narrow interpretation of the exceptional circumstances when it would be deemed that there is no decision to acquire. 2.6. In circumstances where a person may not be aware in advance of any investments made, nor have the ability to influence, object to, or prevent the proposed acquisition or increase in control, the GFSC expects that information regarding those investors (whom the notice giver considers not to have made the decision to acquire) will be provided proactively to the GFSC by the section 111 notice giver at the point of submission of the section 111 notice. The GFSC may request further information under s123 of the FSA regarding the investors as part of its assessment of the suitability of the proposed controllers. An example of a scenario in which this may occur is where persons investing in private equity or venture capital funds will not be regarded as having taken a decision to acquire or to increase control and therefore would not need to notify the GFSC. 2 S111 of the FSA 3 S114(2)(c), and s131(4)(c) of the FSA 4 S107, s111(2) s131(5) of the FSA

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 5 2.7. Should a person cross a threshold under s115 of the FSA or acquire control under s114 of the FSA involuntarily, they should notify the GFSC immediately in writing upon becoming aware of such event even if they intend to reduce their level of holding so that it once again falls below the threshold level. An example of a scenario in which persons may cross a threshold involuntarily includes the repurchase of shares held by other persons which leads directly to such threshold being exceeded. Significant influence 2.8. A proposed acquisition which does not amount to 10% of the shares or voting rights of the Gibraltar regulated firm should be subject to prior notification and the Change of Control assessment if such holding would enable the proposed controller to exercise a significant influence over the management of the Gibraltar regulated firm, whether such influence is actually exercised or not. 2.9. There are several factors relevant to any assessment of whether a person would be considered to be a controller by virtue of exercising significant influence, including the ownership structure (current and proposed) of the Gibraltar regulated firm and the actual level of involvement of the proposed controller in the management of the Gibraltar regulated firm. 2.10. The GFSC expects the following non-exhaustive list of factors to be relevant to any determination of whether significant influence may be exercised: a) whether the proposed controller is a member of, has a representative in or is able to appoint a representative in: i) the management body; ii) the management body in its supervisory function; or iii) any similar body of the Gibraltar regulated firm; b) the ability to direct or influence decisions made by the board, which could be via a shareholder board appointment (to the Gibraltar regulated firm or its parent) or other arrangement, as set out in 2.12(c) to (g) below; c) making recommendations to the board of the Gibraltar regulated firm which are almost always followed, as demonstrated by board minutes; d) the ability to appoint or remove a member of the board of the Gibraltar regulated firm; e) material and regular transactions exist between a person and the Gibraltar regulated firm, (e.g. the proposed controller’s ownership of intellectual property or a material outsourcing vehicle utilised by the Gibraltar regulated firm), which may influence how its business is run; f) additional rights in the Gibraltar regulated firm by virtue of a contract entered into, or of a provision contained in the Gibraltar regulated firm’s articles of association, other constitutional documents or shareholder agreements; g) the existence of veto rights over material matters in relation to the running of the Gibraltar regulated firm such as changes to the business plan or strategy;

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 6 h) the relationship of each member or shareholder with the Gibraltar regulated firm, including any history of collaboration or control; i) the overall ownership structure of the Gibraltar regulated firm or of any parent undertaking, in particular where shareholdings are dispersed and no single party holds a clear controlling interest; j) the existence of agreements or relationships between the proposed controller and other shareholders which could give rise to concerted action or collective influence; k) the position of the proposed controller within the group structure of the Gibraltar regulated firm; and l) the proposed controllers ability to participate in the operating and financial strategy decisions of the Gibraltar regulated firm. Aggregation of holdings (including acting in concert) 2.11. This section sets out the GFSC’s expectations in relation to how one person’s holding of shares or voting power should be aggregated with that of another person for the purposes of determining whether those persons have decided to acquire or increase control over a Gibraltar regulated firm, such that notice is required to be given to the GFSC in accordance with s111 of the FSA. Aggregation of holdings 2.12. The GFSC expects there to be no more than two situations which would require the holdings of two or more persons to be aggregated for the purposes of determining whether they are acquiring or increasing control within the meaning of s114 or s115 of the FSA. 2.13. These situations are where: a) shares or voting power are held, or to be held, by persons acting in concert5 ; and b) where one person’s holding of voting power is attributed to another person (‘deemed voting power’) in addition to any other voting power held6 . 2.14. These situations may apply concurrently, for example, where a person (A) could be acting in concert pursuant to s111(2) of the FSA and have deemed voting power under s107(1) of the FSA where (A) has concluded an agreement that obliges them and a third-party shareholder of the Gibraltar regulated firm to adopt, by concerted exercise of the voting power they hold, a lasting common policy towards the management of the Gibraltar regulated firm. Acting in concert 2.15. There is no applicable definition of the phrase ‘acting in concert’ in the FSA. The GFSC views persons (legal or natural) as ‘acting in concert’ when each of them decides to exercise their rights linked to shares they acquire in accordance with an explicit or implicit agreement made between them. 5 s111(2) of the FSA 6 Refer to the definition of ‘voting power’ in s107(1) of the FSA

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 7 2.16. The GFSC expects that the relevant persons would therefore: a) hold shares and/or voting power in the Gibraltar regulated firm or a parent undertaking of the Gibraltar regulated firm; and b) each take a decision to exercise the rights linked to those shares in accordance with an agreement (in writing or otherwise) between them. 2.17. The GFSC expects that while the rights ‘linked to’ shares for these purposes are most likely going to be voting rights, persons may be acting in concert where they decide to exercise other share-related rights, either in addition to, or instead of, voting rights, in accordance with an agreement made between them. 2.18. Persons will begin acting in concert when they take the decision to exercise their rights in accordance with any agreement between them. This decision may be taken before or after the time the relevant persons decide to purchase shares in the Gibraltar regulated firm. 2.19. The GFSC does not expect such agreements to require persons to always exercise the rights attached to a person’s respective shares in the same way. The GFSC will consider persons to be acting in concert when they take the decision to exercise their rights in accordance with any agreement between them. In most circumstances this will include family members, those with close relationships, or those controlled by a common undertaking. The GFSC will also consider other evidence of collaboration including: a) whether the proposed controller holds a senior management position or is a member of a management body or of a management body in its supervisory function of the Gibraltar regulated firm or is able to appoint such a person; b) the relationship between undertakings in the same group; c) the use by different persons of the same source of finance for the acquisition or increase in control; and d) consistent patterns of voting by the relevant shareholders. The fact that any factor is present does not necessarily in itself lead to the conclusion that the relevant persons are acting in concert. 2.20. Once this decision has been taken, shares or voting power must be aggregated to determine whether control has been, or will be, acquired. This analysis also applies to increases in control and reductions in control as set out in s115 and s116 of the FSA, respectively. The requirement to aggregate the holdings of shares and/or voting power under s111(2) of the FSA may apply to existing holdings, as well as to new purchases of shares and/or voting power. 2.21. Although the term ‘acting in concert’ has a potentially wide meaning, not all common actions taken by persons in relation to shares or voting power will require the aggregation of holdings of shares or voting power for the purposes of s111 of the FSA.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 8 2.22. In particular, there may be circumstances in which persons (who between them hold the percentage level or more of the shares or voting power in a Gibraltar regulated firm or its parent undertaking prompting notification) may engage in a concerted exercise of voting power, without this amounting to acting in concert in a manner requiring aggregation of their holdings. 2.23. The indicative approach is that voting power of persons acting in concert will not be aggregated for the purposes of deeming them to be a parent of an undertaking and/or the undertaking to be a controlled undertaking for the purposes of the definition of voting power in s107(1) of the FSA. 2.24. This concept is illustrated below: • Shareholder A – 20% or more but less than 30% controller via its 20% shareholding in the Gibraltar regulated firm. • Shareholder B – (acting in concert) 50% or more controller via acting in concert with Shareholder D to have an 80% combined shareholding in the Gibraltar regulated firm. • Shareholder C - 30% or more but less than 50% controller via its 100% shareholding in Shareholder B. • Shareholder D – (acting in concert) 50% or more controller via acting in concert with Shareholder B to have an 80% combined shareholding in the Gibraltar regulated firm. • Shareholders E, F and G - are not controllers as Shareholder D is not a controlled undertaking and therefore point (a)(v) of the definition of “voting power” included in s107 of the FSA will not apply. 2.25. Further information in relation to the GFSC’s expectations of acting in concert are provided in Annex 2 and covers ‘deemed voting power’, passive shareholder agreements, cooperating shareholders, conditional agreements, pre-emption rights, drag along rights and tag along rights and the Part 20 definition of acting in concert.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 9 Indirect controllers 2.26. In accordance with s131(3) and (4) of the FSA, a controller can include persons with a direct or indirect holding over a Gibraltar regulated firm which: a) represents 10% or more of the shares or voting power; or b) make it possible to exercise significant influence over the management of the Gibraltar regulated firm. 2.27. When determining whether an indirect holding results in a person acquiring control or increasing control, it is important to note that s107(1) of the FSA includes, in the definition of voting power, indirect holdings of “voting power” in the Gibraltar regulated firm. Annex 1 sets out for the sake of clarity a number of examples of how the criteria in s107(1) of the FSA applies in practice (also refer to Annex 2 for deemed voting power). Limited Partnership Structures 2.28. The majority of private equity and fund manager transactions are typically executed through Limited Partnership (‘Fund’) structures with one or more General Partners (‘GP’) with unlimited liability and one or more Limited Partners (‘LPs’) with limited liability. GPs typically have the power to exercise the voting rights associated with the Fund’s interest in an undertaking or exercise dominant influence over the Fund. There may also be circumstances in which the Fund has arrangements with an Investment Manager to manage its portfolio. In these situations, it should be considered, dependent upon the specific arrangements, whether this person(s) would be a controller. 2.29. Where there are different funds which individually have a holding below the 10% threshold, but share a common GP, consideration should be given to whether the aggregation of voting rights of the Funds is attributable to the GP meaning that the GP is an indirect controller. The Fund may have several LPs investing, who may have no role in its management. However, in certain cases, some LPs may be considered a controller depending on their proportional interest. 2.30. Given that private equity structures and similar types of fund structures can vary in size, nature and complexity, the GFSC would look to determine these on a case-by-case basis. Minority controllers and their parents 2.31. The extended definition of voting power in s107(1) of the FSA, provides that voting power includes in relation to a person (‘H‘) voting power held by a controlled undertaking7 , such as a subsidiary of H. 2.32. Therefore, all parent undertakings in the ownership chain of a minority controller (i.e., non￾parent controllers with voting power in the Gibraltar regulated firm) are captured as controllers of the Gibraltar regulated firm. Each parent undertaking of the minority controller will be assigned the same level of control that the minority controller holds in the Gibraltar regulated firm. 7 The four limbs of what is considered to be a controlled undertaking are set out in s107(2) of the FSA

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 10 2.33. For example, in the below structure the following would apply8 – • B - 50% or more (parent) controller via it being the parent of the Gibraltar regulated firm. • X - 10% or more but less than 20% controller via their 10% holding in a parent (i.e. B) of the Gibraltar regulated firm. • H1 - 10% or more but less than 20% controller via X being a controlled undertaking of H1. • H2 - 10% or more but less than 20% controller via H1, and therefore also X, being a controlled undertaking of H2. • T - is not a controller as H2 is not a controlled undertaking of T as it is not a parent undertaking of H2. 2.34. Note that this example exclusively looks at voting power. It assumes that H2 is not a controlled undertaking of T for any other reason and also does not have significant influence over the management of the Gibraltar regulated firm. 3. Notice of proposed acquisitions and increases in control 3.1. This section sets out the GFSC’s expectations in relation to submitting a section 111 notice and the GFSC's approach to completeness. It also sets out the GFSC’s notification expectations of Gibraltar regulated firms. Submitting the notification (including pre-notification engagement) 3.2. The Change of Control Notification Form (the “Notification Form”) may be accessed and submitted via the GFSC’s online Portal. . The Notification Form contains supporting documents which proposed controllers are required to submit as part of their section 111 notice. Please note that the GFSC is likely to impose additional information requirements in certain cases (based on the post-acquisition impact on the Gibraltar regulated firm). The additional information required will vary depending on the proposals, so controllers are encouraged to engage with the GFSC prior to submitting their notification to discuss what additional information may be required. 8 This example does not include any disregarded holdings. When identifying controllers, you should also consider s117 of the FSA

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 11 3.3. The focus of the early engagement will be on the information required by the GFSC to start its assessment of an acquisition or increase in control over a Gibraltar regulated firm. Engaging with the GFSC prior to the submission of the notification will increase the chances of the notification being deemed as complete and allow the GFSC to commence its assessment of the substance of the notification. For some cases the GFSC may request to see draft documentation prior to submission of the notification. 3.4. For information and details of how to contact the GFSC, please refer to the GFSC’s change of control webpage. Gibraltar regulated firms, and proposed controllers that are already engaging with the GFSC, are encouraged to discuss the proposed acquisition or increase in control with their points of contact at the GFSC to ascertain any additional information that may be required to support the discussion and assessment of their proposals. 3.5. Examples of where the GFSC might impose additional informational requirements include: a) Transformative change of control – this scenario refers to proposed acquisitions that trigger the application of s83A of the FSA. The GFSC will generally consider a Change of Control application before considering and processing a s83A application. Please refer to the GFSC’s Guidance Note on Section 83A9 for further information. Note that the GFSC may require additional information on the cost-benefit analysis undertaken by the proposed controller in order to understand the rationale for the acquisition against another regulatory application route. b) Complex groups – transactions where the proposed controller or the Gibraltar regulated firm has a complex group structure may require additional information to be provided to the GFSC to assist the GFSC in its assessment of the supervisibility of the Gibraltar regulated firm and group. This includes where the proposed transaction is likely to create a larger firm/group with significant market share. c) Cross-border transactions – additional information on the timings and progress of linked transactions happening in other jurisdictions will likely be necessary. d) Transactions involving the use of substantial debt financing – the GFSC may request additional information, and have further questions, when the acquisition involves substantial debt financing in order to be satisfied as to the financial soundness of the acquisition and the potential impact on the Gibraltar regulated firm. Examples of the type of information the GFSC may require include: i) copies of external and internal debt/loan agreements; ii) evidence to support ability to repay the debt/loan including any dividend upstreaming, debt/loan repayment profile; and iii) liquidation ratios/projections. 9 GFSC Guidance Note on Section 83A of the FSA

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 12 e) Private equity or hedge fund ownership – the additional information likely to be requested in these cases is: i) a detailed description of the performance of previous acquisitions by the proposed controller (or any person in their ownership structure that would be deemed to be a controller) of the Gibraltar regulated firm in financial institutions; ii) details of the proposed controller’s investment policy and any restrictions on investment, including details on investment monitoring, factors serving the proposed controller as a basis for investment decisions related to the Gibraltar regulated firm and factors that would trigger changes to the proposed controller’s exit strategy; iii) the proposed controller’s decision-making framework for investment decisions, including the name and position of the individuals responsible for making such decisions; and iv) where the private equity or hedge fund is not authorised by the GFSC, a detailed description of the proposed controller’s anti-money laundering, counter-terrorist financing and counter-proliferation financing procedures and of the anti-money laundering legal framework applicable to it. f) Controlling of two or more Gibraltar regulated firms – when the proposed acquisition would lead to the proposed controller controlling two or more Gibraltar regulated firms, the GFSC is likely to request further information on any conflicts, or potential conflicts of interest, and how these will be mitigated. g) Transactions involving firms falling under newer regimes or high-risk business models – for example firms that fall under the Investment Firms Prudential Regime may require longer ranging group forecasts or management accounts, as well as evidence of being able to meet the higher capital and liquidity requirements. h) Sovereign Wealth fund ownership – the additional information likely to be requested in these cases is: (i) the name of the ministry or government department in charge of defining the investment policy of the fund; (ii) details of the investment policy and any restrictions on investment; (iii) the name and position of the individuals responsible for making the investment decisions for the fund; and (iv) details of any influence exerted by the identified ministry or government body/department/ministry on the day-to-day operations of the fund and the Gibraltar regulated firm. i) Proposed controller will become a parent financial holding company, or a parent mixed financial holding company – for example, where the proposed transaction means the proposed controller becomes a parent financial holding company or a parent mixed financial holding company in Gibraltar, and the company must be approved by the GFSC under the Financial Servies (Credit Institutions and Capital Requirements) Regulations 2020 unless that company is exempt from approval. j) Linked Variations of Permissions (‘VoPs‘) – if the proposed business plan for the Gibraltar regulated firm includes a variation of permission, then this will not be fully assessed (only the Gibraltar regulated firm can submit a VoP application) until post￾acquisition when a variation of permission application can be submitted. However, the GFSC expects that further information on the proposals will need to be submitted as part of the section 111 notice in order for the GFSC to complete its assessment. The GFSC would also expect information to be submitted on what would happen if the VoP would not be approved. Note that depending on the VoP being proposed, the GFSC may consider this to be transformative.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 13 Information requirements – varying or waiving 3.6. The GFSC may set out, on its website, reductions in the information required as part of the notification (e.g., specific information for intragroup changes in control). 3.7. The GFSC may also vary or waive some of its information requirements on a case-by-case basis where it is proportionate to do so. Prior engagement with the GFSC will allow the GFSC to consider the level of information required as part of the notification. 3.8. Under certain circumstances, such as in the case of acquisitions by means of a public offer, it is recognised that the proposed controller may encounter difficulties in obtaining information which is usually required. In these cases, the proposed controller should bring such difficulties to the GFSC’s attention. 3.9. The GFSC recognises that where the proposed controller is a government, or government body/department/ministry, providing the information set out in the controller forms may not be relevant and/or difficult to obtain. In these circumstances the GFSC may vary or waive notification requirements, but this should be discussed with in advance. Forms to be submitted for multiple entities controlled by the same person 3.10. The GFSC may accept one controller notification form covering multiple controllers where they are part of the same group or controlled by the same legal or natural person and where the s111 information is common across multiple controllers. In particular, groups who make several acquisitions over a 12-month period are encouraged to discuss information requirements with the GFSC prior to formal submission. 3.11. This approach is particularly applicable to intra-group changes in control but can also apply to other types of acquisitions or increases in control and therefore should be discussed with the GFSC in advance. Completeness of the notification 3.12. The GFSC will deem a section 111 notice as complete (as per s113(1) and s122(1) of the FSA this commences the assessment period) when it includes all the required information (see previous section on information requirements) for the purposes of commencing the assessment and the prescribed fee has been paid. The required information includes: a) the change of control notification form and supporting documentation; b) any additional information required by the GFSC; and c) the results of due diligence checks carried out by the GFSC, including the receipt of any information requested from third parties to verify information provided as part of the section 111 notice. 3.13. The GFSC will acknowledge in writing receipt of a completed section 111 notice as soon as reasonably possible. This acknowledgement does not prejudice the GFSC’s entitlement to request further information, nor is it an indication as to the outcome of the GFSC’s assessment. The information provided as part of the notification may still subsequently be assessed to be incomplete, especially if any new information comes to light or there are amendments to the specifics of the proposed acquisition.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 14 3.14. For incomplete notifications, the GFSC will inform the notice giver as soon as reasonably possible. The GFSC is not required to specify the missing information in the acknowledgement of receipt but may detail such information separately, in writing, within a reasonable time period. 3.15. Where the GFSC receives a completed section 111 notice, the GFSC will within the assessment period: a) propose to approve the acquisition to which the notice relates unconditionally; or b) propose to approve the acquisition subject to conditions; or c) object to the acquisition. 3.16. The assessment period begins on the day the GFSC acknowledges receipt of a completed section 111 notice and ends: a) 60 working days later in the change of a change of control which the GFSC consider to be non-complex or moderately complex; or b) 6 months later in the case of a change of control which the GFSC considers to be complex. Note that the assessment period may be interrupted where the GFSC in writing asks the section 111 notice giver to provide further information under s123 of the FSA. 3.17. The complexity of the change of control will be assessed by the GFSC upon receipt of the change of control notification form and supporting documentation. This complexity classification (i.e., non-complex, moderately complex, or complex) determines the length of the assessment period. Further details on complexity assessments can be found on the GFSC’s complexity assessments webpage10 . 3.18. The legislative timeframes set out in paragraph 3.16 above remain the official processing deadlines. However, the GFSC has established Service Level Standards (SLS) to enhance regulatory efficiency. Further details on the GFSC’s SLSs can be found on the GFSC’s Service Level Standards webpage11 . Ministerial consent for credit institutions 3.19. Credit institutions should note the following when considering a change to its ownership or control: a) the GFSC will not approve any such change without prior Ministerial consent12; b) this applies where one or more persons, acting alone or together, directly or indirectly, hold or control more than 20% of the shares or voting power in the credit institution13; and c) the credit institution must not be a credit institution in the United Kingdom14 . 10 https://www.fsc.gi/ComplexityAssessments 11 https://www.fsc.gi/SLS 12 Financial Services (Credit Institutions and Capital Requirements) Regulations 2020, reg 14(3) 13 Financial Services (Credit Institutions and Capital Requirements) Regulations 2020, reg 14(3) 14 Financial Services (Credit Institutions and Capital Requirements) Regulations 2020, reg 14(3)

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 15 3.20. If the GFSC decides to approve such a proposed change of control, whether subject to conditions or not, the GFSC will seek written consent from the Minister with responsibility for financial services. The Minister may refuse consent if it is considered to be against the public interest of Gibraltar.15 3.21. However, if the GFSC decides not to approve such a proposed change of control, it will not need to seek Ministerial consent. 3.22. While the GFSC is responsible for seeking ministerial consent, firms must cooperate fully and ensure timely and complete submissions. GFSC’s Notification Expectations of Gibraltar Regulated Firms 3.23. Core Principle 12 requires Gibraltar regulated firms to deal with its regulators in an open, co￾operative and timely way and disclose to them any matter of which they would reasonably expect notice. The GFSC expects Gibraltar regulated firms to notify them of any proposed or actual change of control, regardless of whether the controller or proposed controller has fulfilled or intends to fulfil their own notification obligations under the FSA. Even if the controller or proposed controller fails to notify the GFSC, the Gibraltar regulated firms must notify the GFSC. Sector-specific regulations such as the Financial Services (Credit Institutions) Regulations 2020 also oblige firms to promptly inform the GFSC of an acquisition of control, increase of control or disposition of control. 3.24. Gibraltar regulated firms should discuss with the GFSC, at the earliest opportunity, any prospective changes of which it is aware, in a controller’s or proposed controller’s shareholdings or voting power. These discussions may take place before the formal notification requirement arises. As a minimum, the GFSC considers that such discussions should take place before a person: a) enters into any formal agreement in respect of the purchase of shares or a proposed acquisition or merge which would result in a change of control (whether or not the agreement is conditional upon any matter, including the GFSC’s approval); or b) purchases any share options, warrants or other financial instruments, the exercise of which would result in the person acquiring control, or any other change of control. 3.25. The notification by a Gibraltar regulated firm must: a) be in writing; b) contain the information set out on the GFSC’s website; and c) be made: i) as soon as the firm becomes aware that a person, whether alone or acting in concert, has decided to acquire control or to increase or to reduce control; or ii) within 14 days of the firm becoming aware of the change of control concerned if the change of control takes place without the knowledge of the firm. 15 Financial Services (Credit Institutions and Capital Requirements) Regulations 2020, reg 14(3)

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 16 3.26. The GFSC expects Gibraltar regulated firms to take reasonable steps to keep themselves informed of the identity of their controllers. This includes monitoring its register of members (or equivalent) as well as monitoring the entitlement of delegates or persons with voting rights to exercise or control voting power at general meetings. 4. Assessment of the proposed acquisition 4.1. This section sets out the GFSC’s approach to the assessment criteria used to assess notifications to acquire or increase control in a Gibraltar regulated firm. The GFSC’s approach 4.2. Notifications for a change of control are assessed in accordance with the procedure set out in s122 of the FSA and the criteria set out in s118 and s119 of the FSA. 4.3. When carrying out its assessment, the GFSC, as per s118(2)(b) of the FSA, will have regard to the likely influence that the s111 notice-giver will have on the Gibraltar regulated firm. 4.4. In addition, the GFSC may vary the intensity of the assessment and composition of the required information based on the nature, size and complexity of the transaction, as well as taking into account: a) the regulatory history of the proposed controller; and b) whether or not the proposed controller (or its group) is supervised in a third country deemed equivalent; c) the nature of the proposed controllers; d) the objective of the acquisition or increase of control; e) the degree of involvement of the proposed controller in the management of the Gibraltar regulated firm; and f) the size of the holding to be acquired. 4.5. Non-exhaustive examples of where the GFSC may take this approach include: a) intra-group transactions – the GFSC’s assessment may only be focused on the impact of the change in group structure; b) where the proposed controller is known to the GFSC and is in possession of up-to-date information – the GFSC may deem it sufficient to only assess the corporate controller at the top of the control chain; and c) where there is a change in the nature of the controller (i.e. moving up a control band) the GFSC may limit its assessment to the changes having occurred since the date of the last assessment and/or any proposed changes that may impact the Gibraltar regulated firm. 4.6. The GFSC will assess all matters on a case-by-case basis. There may be circumstances where the GFSC requires further information to conduct its assessment and this may depend on factors such as the nature of the changes being proposed, the length of time since the last assessment, and the materiality of information provided. The GFSC will communicate any changes in approach to the proposed controller as soon as possible.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 17 4.7. There may be circumstances where the GFSC contacts other supervisory authorities and requests information relevant to its assessment against the criteria of s118 and s119 of the FSA. Any contact with other authorities or regulators will be in accordance with the GFSC’s legal obligations of confidentiality. 4.8. Under certain circumstances, such as in the case of acquisitions by means of a public offer, the proposed controller may encounter difficulties in obtaining information which is needed to establish a full business plan or provide other information that the GFSC would usually expect. In these cases, the proposed controller should bring such difficulties to the attention of the GFSC and point out the aspects of its business plan that that may be impacted and/or modified in the near future. 4.9. In well-justified circumstances, the GFSC will not oppose the proposed acquisition on the sole basis of the lack of some required information, the absence of which can be justified by the nature of the transaction, if the information provided appears sufficient to understand the likely outcome of the acquisition for the Gibraltar regulated firm and to carry out the assessment and provided that the proposed controller undertakes to provide the missing information as soon as possible after the closing of the acquisition. 4.10. The GFSC encourages early engagement from proposed controllers (or those seeking to increase control) to discuss notification requirements. The reputation of the proposed controller 4.11. The GFSC’s assessment of the reputation of the proposed controller covers two elements: a) integrity; and b) professional competence. 4.12. In carrying out this assessment, the GFSC expects to consider the Gibraltar regulated firm and the proposed controller’s influence/role in the Gibraltar regulated firm. Integrity 4.13. The integrity assessment will be applied to all acquisitions and increases in control regardless of the size of the holding that the proposed controller intends to acquire and of its involvement in the management or the influence that it is planning to exercise on the Gibraltar regulated firm. The GFSC expects the assessment to extend to cover the legal and beneficial owners of the proposed controller. If the proposed controller is a legal person, the assessment of integrity will also cover the persons who effectively direct the business of the proposed controller. 4.14. The GFSC will always carry out an integrity assessment in respect of the proposed controller(s), even when the proposed controller has previously been assessed, as there may have been further developments since the date of the previous assessment. However, the GFSC may draw on the outcome of previous relevant integrity assessments when deciding on the level and extent of new information sought. If the GFSC has reasonable grounds to assume that the outcome of a new integrity assessment might be different from an existing assessment, for example because it is aware of adverse information concerning the proposed controller, a full integrity check will be performed.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 18 4.15. The circumstances set out in paragraph 4.411 are also relevant for the assessment of the proposed controller’s integrity but do not constitute, by themselves, sufficient grounds for the GFSC to assume the proposed controller’s integrity. 4.16. If any of the situations contemplated in paragraph 4.411 apply in respect of a proposed controller supervised by a competent supervisor in a third country considered equivalent, the assessment of the integrity and professional competence may be facilitated by cooperating with the competent supervisory authority in such third country. 4.17. When considering whether to rely on the assessment carried out by another authority, the GFSC will take into account the extent to which such other competent authorities will be able to share all relevant information about the proposed controller, including any measures or concerns that may not have been made public. 4.18. The proposed controller will be considered to be of good repute if there is no reliable evidence to suggest otherwise and the GFSC has no reasonable grounds to doubt the proposed controller’s good repute. All relevant information available for the assessment will be taken into account, without prejudice to any limitations imposed by Gibraltar law and regardless of the jurisdiction where any relevant events occurred. 4.19. Any criminal or relevant administrative records will be taken into account. As part of the assessment the GFSC may consider the type of conviction or indictment or other administrative action, the level of appeal, the sanction received, the phase of the judicial process reached and the effect of any rehabilitation measures. 4.20. Other matters which the GFSC may consider include the surrounding (including mitigating) circumstances and the seriousness of any relevant offence or administrative or supervisory action, the time period elapsed and the proposed controller’s conduct since the offence, as well as the relevance of the offence or administrative or supervisory action to the proposed controller’s status as a current controller of a Gibraltar regulated firm. The GFSC may judge the relevance of criminal records differently according to the type of conviction or decision, whether it is still possible to appeal against the sanction (definitive vs. non-definitive convictions), the type of punishment (imprisonment vs. less severe sanctions), the length of the sentence (more vs. less than a specified period), the phase of the judicial process reached (conviction, trial, indictment) and the effect of rehabilitation. 4.21. The cumulative effects of more minor incidents, which individually do not impinge on the reputation of a proposed controller but might collectively have a material impact, may also be considered. 4.22. The GFSC may take particular account of the following factors, which may call into question the integrity of a proposed controller: a) any conviction or prosecution of a criminal offence, in particular: i) any offences under the laws governing financial services; ii) any offences of dishonesty, fraud or financial crime, including money laundering and terrorist financing, proliferation financing, market manipulation, insider trading, usury and corruption; iii) any tax offences; iv) any other offences under legislation relating to companies, bankruptcy, insolvency or consumer protection;

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 19 b) any relevant findings from onsite and off-site controls or inspections, from investigations or enforcement actions, to the extent that they relate to the proposed controller either directly or indirectly, by way of its ownership or control, and the imposition of any administrative sanctions for non-compliance with any financial services legislation or other matters contemplated in sub-paragraph (a) above; c) any relevant enforcement actions by any other regulatory or professional bodies for non-compliance with any relevant provisions; and d) any other information from credible and reliable sources that is relevant in this context. When considering whether information from other sources is credible and reliable, the GFSC will consider both the extent to which the source is public and trustworthy, as well as the extent to which the information is provided by several independent and reputable sources, is consistent over a period of time and that there are no reasonable grounds to suspect that it is false. 4.23. Among other things, the GFSC will consider the impact of allegations, their nature and re￾occurrence and pending criminal, administrative or enforcement investigations and may seek to mitigate risks by imposing conditions on an approval, where appropriate to do so. However, in some circumstances the proposed controller may wish to consider whether contemplating the proposed transaction at this time remains appropriate. 4.24. The GFSC considers that the absence of a criminal conviction or prosecution, administrative or enforcement action may not constitute in and of itself sufficient evidence of a proposed controller’s integrity, in particular, where allegations of criminal conduct persist. 4.25. Attention will be paid to the following factors regarding the propriety of the proposed controller in respect of past business dealings: a) any evidence that the proposed controller has not been transparent, open and cooperative in its dealings with regulatory authorities; b) any refusal of any registration, authorisation, membership or licence to carry out a trade, business or profession, any revocation, withdrawal or termination of such registration, authorisation, membership or licence and any expulsion or suspension from a professional body or association; c) the reasons for any dismissal or suspension from employment or any position of trust, fiduciary relationship or other similar situation, as well as any request to resign from such a position; d) any disqualification by any regulator from acting as a person who directs the business; and e) a history of insolvencies resulting in significant unpaid customer liabilities where the proposed controller was a director, or involved within one year of its dissolution. 4.26. The GFSC will assess the relevance of such situations on a case-by-case basis, recognising that the characteristics of each situation may be more or less severe and that the aggregation of some situations may be significant when considered together, even though each of them in isolation may not be significant.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 20 4.27. In cases involving the person becoming a controller, the information requirements on which the assessment of integrity is based may vary according to the nature of the controller (natural vs. legal person, regulated or supervised entity vs. unregulated entity). 4.28. The GFSC will take risk-sensitive measures to verify the existence of adverse events relating to the proposed controller, including by asking the proposed controller, to the extent not already provided, to supply documents evidencing that no such events have occurred (for instance, recent extracts from the criminal register, if the relevant authority issues such extracts) and, if necessary, by requesting confirmation from other authorities (including judicial authorities or other regulators), regardless of whether such authorities are domestic or foreign. The GFSC may also consider, to the extent they are relevant, and with due regard to the reliability of the source, other indications of wrongdoing, such as adverse media reports and allegations. 4.29. Failure by the proposed controller to provide the extracts contemplated in the aforementioned paragraphs, or the delayed submission thereof or the submission of an incomplete declaration may impact the GFSC’s integrity assessment. 4.30. When assessing the integrity of the proposed controller, the GFSC may take into consideration the integrity of any person linked to the proposed controller, including any person who has, or appears to have, a close family or business relationship with the proposed controller. Professional competence 4.31. The professional competence of the proposed controller covers competence in management (the ‘management competence’) and in the area of the financial activities carried out by the Gibraltar regulated firm (the ‘technical competence’). 4.32. The management competence may be based on the proposed controller’s previous experience in acquiring and managing holdings in companies. The GFSC considers that such experiences should demonstrate due skill, care, diligence and compliance with the relevant standards. 4.33. The assessment of technical competence should relate primarily to the financial activities currently performed by the proposed controller and/or by companies in the group to which it belongs. 4.34. The GFSC may base its assessment of technical competence on the proposed controller’s previous experience in operating and managing financial services firms as a controlling shareholder or as a person who effectively directs the business of a financial firm. The GFSC expects such experience to demonstrate due skill, care, diligence and compliance with the relevant standards. The GFSC may, in particular, consider any historic or pending insolvencies and the circumstances that led to those events. 4.35. In its assessment of professional competence, the GFSC expects to take into account the influence that the proposed controller will have over the Gibraltar regulated firm. Therefore, the GFSC may reduce the competence requirements for proposed controllers who are not in a position to exercise, or undertake not to exercise, significant influence over the Gibraltar regulated firm. In such circumstances, the evidence of adequate management competence may be sufficient.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 21 4.36. If the proposed controller is a legal person, the GFSC expects to assess both the legal person and all of the persons who effectively direct its business. 4.37. In the case of an increase in control, and to the extent that the professional competence of the proposed controller has been assessed previously by the GFSC, the GFSC expects the relevant information to be updated as appropriate. The updated assessment of the professional competence of the proposed controller should take into account the increased influence and responsibility associated with the increased holding. 4.38. Persons may acquire significant holdings in financial firms with the aim of diversifying their portfolio and/or obtaining dividends or capital gains, rather than with the aim of becoming involved in the management of the Gibraltar regulated firm concerned. The GFSC expects to consider the likely influence of the proposed controller over the Gibraltar regulated firm, and may reduce the professional competence requirements for this type of controller. 4.39. Similarly, when the acquisition allows the proposed controller to exercise a strong influence, the GFSC considers that the need for technical competence will be greater, considering that the controlling shareholders will be able to define and/or approve the business plan and strategies of the Gibraltar regulated firm concerned. In the same way, the GFSC expects to consider the nature and complexity of activities envisaged in determining the degree of technical competence needed. 4.40. The GFSC may also consider the following situations regarding past and present business performance and financial soundness of a proposed controller with regards to their potential impact on the person’s professional competence: a) any inclusion on any list of unreliable debtors or any similar negative records with a credit bureau, if available; b) the financial and business performance of any entities owned or directed by the proposed controller or in which the proposed controller had or has a significant share with special consideration to any rehabilitation, bankruptcy and winding-up proceedings and whether and how the proposed controller has contributed to the situation that led to the proceedings; c) any declaration of personal bankruptcy; and d) any civil lawsuits, administrative or criminal proceedings, large investments or exposures and loans taken out, in so far as they can have a significant impact on the financial soundness. 4.41. Subject to paragraph 4.177 above, the professional competence requirement will generally be considered to be met if: a) the proposed controller is a person already considered to be sufficiently competent in its capacity as a holder of a holding in another financial institution which is supervised by one or more of the GFSC, the PRA or the FCA; b) the proposed controller is a natural person who already directs the business of the same or another financial institution which is supervised by one or more of the GFSC, the PRA or the FCA; or

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 22 c) the proposed controller is a legal person regulated and supervised as a financial institution by one or more of the GFSC, the PRA or the FCA; and there is no new or revised evidence that could cast reasonable concerns regarding the proposed controller’s professional competence. For instance, just because a proposed controller has been judged competent to control (for example) a small firm providing financial advice, it does not necessarily mean that it is competent to control a more significant firm, such as a large credit institution. The reputation, knowledge, skills and experience of those who will direct the business of the Gibraltar regulated firm as a result of the proposed acquisition 4.42. Where the proposed controller is in a position to appoint new persons to direct the business of the Gibraltar regulated firm as a result of the proposed acquisition and proposes to do so, such persons need to be fit and proper. Such persons will likely be captured by the Regulated Individual (‘RI‘) Regime where an assessment of their reputation, knowledge, skills and experience will be carried out. The same assessment will be carried out where an individual is to be appointed in a non-executive capacity and they will, as a result, be captured by the RI regime. 4.43. Where an individual is to be appointed in a non-executive capacity, but will remain outside the scope of the RI regime, the GFSC will carry out a similar assessment of reputation, knowledge, skills and experience in any event. 4.44. Where possible, the appropriate RI application should be submitted at the same time, or shortly after, the section 111 notice is submitted. 4.45. It may not always be possible to submit the RI application in advance, as the application must be submitted by the Gibraltar regulated firm at which the role will be performed, and such Gibraltar regulated firm may not be prepared to do so at the time the change of control notification is submitted. Under these circumstances, the GFSC is likely to request a draft RI application as part of its assessment under this criterion. However, any consideration of the draft RI application is without prejudice to the subsequent assessment that will be conducted when the formal application is submitted. 4.46. Where the proposed controller intends to appoint an individual to direct the business of the Gibraltar regulated firm and the GFSC is not satisfied that the person is fit and proper to perform the proposed role, the GFSC may oppose the proposed acquisition. The financial soundness of the proposed controller 4.47. In assessing the financial soundness of the proposed controller, the GFSC expects to consider the capacity of the proposed controller to finance the proposed acquisition and to maintain, for the foreseeable future (usually three years), a sound financial structure in respect of the proposed controller and of the Gibraltar regulated firm. This capacity should be reflected in the overall aim of the acquisition and the policy of the proposed controller regarding the acquisition, but also – if the proposed acquisition would result in control of 50% or more in the Gibraltar regulated firm, or the Gibraltar regulated firm otherwise becoming a subsidiary of the proposed controller – in the forecasted financial objectives, consistent with the strategy identified in the business plan.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 23 4.48. The GFSC will determine whether the proposed controller is sufficiently sound from a financial point of view to ensure the sound and prudent management of the Gibraltar regulated firm for the foreseeable future (usually three years), considering the nature of the proposed controller and of the acquisition. 4.49. The GFSC may object to the acquisition if it considers, based on its analysis of the information received, that the proposed controller is likely to face financial difficulties during the acquisition process or in the foreseeable future. In doing so, the GFSC will take into account all asset types (including intangibles) and liabilities held and to be held by the proposed controller. 4.50. The GFSC may also analyse whether the financial mechanisms put in place by the proposed controller to finance the acquisition, or existing financial relationships between the proposed controller and the Gibraltar regulated firm, could give rise to conflicts of interest that could affect the Gibraltar regulated firm. 4.51. In determining the necessary depth of the assessment of the financial soundness of the proposed controller, the GFSC may consider the likely influence of the proposed controller, the nature of the proposed controller (for instance, whether the proposed controller is a strategic or a financial investor, including whether it is a private equity fund or a hedge fund) and the nature of the acquisition (for instance, whether the transaction is significant or complex). The GFSC expects that differences in the characteristics of the acquisition may justify differences in the depth and methods of the analysis. 4.52. The information required for the assessment of the financial soundness of the proposed controller may depend on the status of the proposed controller, for example, whether it is already supervised by the GFSC or it is a natural person. 4.53. If the proposed controller is a financial institution subject to supervision by another competent supervisory authority, the GFSC may consider that authority’s assessment of the proposed controller's financial situation, together with any documents transmitted directly by the supervisory authority to the GFSC. 4.54. If the proposed controller is supervised by the Financial Conduct Authority (FCA) and/or the Prudential Regulation Authority (PRA), the GFSC may place significant reliance on their assessment of the financial soundness of the proposed controller, as they have all the information on the profitability, liquidity and solvency of the proposed controller, as well as on the availability of the resources for the acquisition. However, the GFSC retains the discretion to disagree with the evaluation of either authority. 4.55. Where the proposed controller is a financial entity supervised by a competent supervisory authority in a third country deemed equivalent, the GFSC may facilitate its assessment through cooperation with that authority. 4.56. Whilst the use of borrowed funds to finance the acquisition should not, in and of itself, lead to the conclusion that the proposed controller is unsuitable, the GFSC may assess if such indebtedness negatively affects the financial soundness of the proposed controller or the Gibraltar regulated firm’s capacity to comply with prudential requirements (including, where relevant, the commitments provided by the proposed controller to meet prudential requirements).

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 24 4.57. The GFSC’s assessment may also cover, where relevant, the capacity of the proposed controller to provide further capital to the Gibraltar regulated firm in the short to medium term, and if necessary, its stated intentions in respect of whether it would provide such capital. 4.58. When calibrating the assessment of the financial soundness of a proposed controller, the GFSC will take into account the nature of the proposed controller, as well as the degree of influence the proposed controller would have over the Gibraltar regulated firm following the proposed acquisition. In this regard, the GFSC will distinguish between cases where control over the Gibraltar regulated firm is acquired and cases where the proposed controller would be likely to exercise little or no influence. If a proposed controller gains control over the Gibraltar regulated firm, the assessment of the financial soundness of the proposed controller should also cover the capacity of the proposed controller to provide further capital to the Gibraltar regulated firm in the mid-term, if necessary, and its stated intentions in respect of whether it would provide such capital. Whether the Gibraltar regulated firm will be able to comply with its prudential requirements and threshold conditions 4.59. The proposed acquisition should not adversely affect the Gibraltar regulated firm’s compliance with prudential requirements, including the threshold conditions. The specific assessment of the proposed controller’s plan at the time of the acquisition is complementary to the responsibilities of the GFSC for the ongoing supervision of the Gibraltar regulated firm. 4.60. The GFSC may take into consideration the proposed controller’s declared intentions towards the Gibraltar regulated firm expressed in its strategy (including as reflected in the business plan). The GFSC expects this to be backed up by appropriate commitments and evidence from the proposed controller, where appropriate, to support the Gibraltar regulated firm to meet its prudential requirements. These commitments may include, for example, financial support in case of liquidity or solvency problems, corporate governance issues, the proposed controller’s future target share in the Gibraltar regulated firm and directions and goals for development. 4.61. The GFSC will assess the ability of the Gibraltar regulated firm to comply at the time of the proposed acquisition, and to continue to comply after the acquisition, with all prudential requirements, including capital requirements, liquidity requirements and large exposures limits, as well as with requirements related to governance arrangements, regulatory reporting, internal control, risk management and compliance. 4.62. If the Gibraltar regulated firm will be part of a group as a result of the proposed acquisition, the GFSC will need to be satisfied it will not be prevented from exercising effective supervision, from effectively exchanging information with other relevant supervisors within the group, or from determining the allocation of responsibilities among the relevant subsidiary supervisors by the close links of the new group of the Gibraltar regulated firm to other natural or legal persons. In addition, the GFSC will need to be satisfied that it will not be prevented from fulfilling its monitoring duties by the laws, regulations or administrative provisions of another country governing a natural or legal person with close links to the Gibraltar regulated firm, or by difficulties in the enforcement of those laws, regulations or administrative provisions.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 25 4.63. The GFSC will also consider the proposed controller’s capacity to support adequate organisation of the Gibraltar regulated firm within its new group. The GFSC expects both the Gibraltar regulated firm and the group to have clear and transparent corporate governance arrangements and adequate organisation. 4.64. The group of which the Gibraltar regulated firm will become a part should be adequately capitalised. Under certain circumstances, the group may itself become subject to prudential requirements on a consolidated basis. In those circumstances, the GFSC will take into account any relevant Guidance Notes it has issued relating to group supervision. 4.65. The GFSC expects to consider whether the proposed controller will be able to provide the Gibraltar regulated firm with the financial support it may need for the type of business pursued by and/or envisaged for it, to provide any new capital that the Gibraltar regulated firm may require for future growth in its activities and to implement any other appropriate solution to accommodate the Gibraltar regulated firm’s needs for additional own funds. 4.66. If the proposed acquisition would result in control of 50% or more, or the Gibraltar regulated firm becoming a subsidiary of the proposed controller, this criterion may be assessed as part of the assessment process as at the time of acquisition and on a continuous basis for the foreseeable future (three to five years). Therefore, the business plan provided by the proposed controller to the GFSC should cover at least this period. 4.67. The business plan should clarify the plans of the proposed controller concerning the future activities and organisation of the Gibraltar regulated firm. This should include a description of its proposed group structure. The plan should also evaluate the financial consequences of the proposed acquisition and include a medium-term forecast. Whether there are reasonable grounds to suspect that in connection with the proposed acquisition (i) money laundering, terrorist financing or proliferation financing is being or has been committed or attempted or (ii) the risk of such activity could increase 4.68. The anti-money laundering, terrorist financing and proliferation financing assessment complements the integrity assessment and should be carried out regardless of the value and other characteristics of the acquisition. The GFSC will object to the proposed acquisition/increase in control if: a) it knows or suspects, or has reasonable grounds for knowing or suspecting, that the proposed controller or any connected party is or was involved in money laundering operations or attempts, irrespective of whether it is directly or indirectly linked to the proposed acquisition; b) it knows or suspects, or has reasonable grounds for knowing or suspecting, that the proposed controller or any connected party has carried out terrorist activities or terrorist financing; c) it knows or suspects, or has reasonable grounds for knowing or suspecting, that the proposed controller or any connected party has carried out proliferation financing; or d) the proposed acquisition increases the risk of money laundering, terrorist financing or proliferation financing.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 26 4.69. This assessment criterion may also cover persons with close personal or business links (including through any family member or persons known to be close associates) to the proposed controller, including the legal and beneficial owners of the proposed controller. 4.70. In order to assess the above, the GFSC will consider the information available such as evaluations, assessments or reports drawn up by international organisations and standard setters such as Transparency International, the Organization for Economic Co-operation and Development (’OECD’), the World Bank and the Financial Action Task Force (‘FATF‘), as well as open media searches and such other sources as may be available to the GFSC. 4.71. The GFSC will consider in relation to all available information: a) if the proposed controller or a connected party is subject to a financial sanctions regime; b) if the proposed controller or a connected party is a politically exposed person as defined in s20A of the Proceeds of Crime Act 2015 c) the source of the funds that will be used for the proposed acquisition (please refer to paragraphs 4.74 and 4.75 below); d) whether there is missing information, information that is considered incomplete, insufficient or which gives rise to suspicion – for example, capital movements not accounted for, cross-border relocations of headquarters, reshuffles in management or legal person owners, earlier associations of the owners, or the management of the company by criminals. Such factors may prompt increased supervisory diligence and requests for further information. If reasonable suspicion subsists, the GFSC will object to the acquisition; e) whether the proposed controller’s business itself has insufficient anti-money laundering, terrorist financing and proliferation financing controls as determined by the GFSC; f) if the proposed controller has valued the Gibraltar regulated firm significantly higher than its market value considering its status as either a trading or dormant firm; g) whether the proposed controller is established in or has relevant personal or business links itself (or through any family member or persons known to be close associates) with a country or territory on FATF Black and Grey lists; h) whether the proposed controller is established in or has relevant personal or business links itself (or through any family member or persons known to be close associates) with a country or territory where the legislation does not allow for the application of anti￾money laundering, and terrorist financing and proliferation financing combating measures as that of Gibraltar. 4.72. In the absence of specific evidence such as no criminal records, or where there are currently no reasonable grounds to suspect that money laundering, terrorist financing or proliferation financing is being committed or attempted, if the proposed acquisition nevertheless gives rise to reasonable grounds to suspect an increased risk of money laundering, terrorist financing or proliferation financing, the GFSC may consider objecting.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 27 4.73. This could be the case, for example, if the proposed controller is established in or has relevant personal or business links itself (or through any family member or persons known to be close associates) with a country or territory identified by the FATF as having strategic deficiencies that pose a risk to the international financial system or with a country or territory identified by the European Commission as having strategic deficiencies in its national anti-money laundering, counter-terrorist financing or counter proliferation financing regime that pose significant threats to the financial system. In any event, particular attention should be paid where the legislation of the third country does not permit the application of anti-money laundering and terrorist financing and proliferation financing combating measures consistent with those applicable in Gibraltar. The GFSC will also consider the relevant reports of organisations such as Transparency International, the OECD and the World Bank. 4.74. Within this context, the GFSC will also assess information regarding the source of funds that will be used for the proposed acquisition, including both the activity that generated the funds as well as the means through which they have been transferred, to assess whether this may give rise to an increased risk of money laundering, terrorist financing or proliferation financing. The GFSC will verify that: a) the funds used for the acquisition are channelled through chains of financial institutions, all of which are subject to effective anti-money laundering, terrorist financing and proliferation financing supervision by competent authorities that, based on credible sources such as mutual evaluations, detailed assessment reports or published follow-up reports, have requirements to combat money laundering, terrorist financing and proliferation financing consistent with the FATF Recommendations and effectively implement those requirements; b) the information on the activity that generated the funds, including the history of the business activities of the proposed controller and on the financing scheme is credible and consistent with the value of the deal; and c) the funds have an uninterrupted paper trail back to their origins, or other information that allows the GFSC to resolve all doubts as to their legal origin. 4.75. In instances where the GFSC is unable to verify the source of funds in the manner described in paragraph 4.74, the GFSC will consider whether the explanation provided by the proposed controller is reasonable and credible, having regard to the outcome of the proposed controller’s integrity assessment. 5. GFSC’s approach to the use of conditional approvals to advance its regulatory objectives 5.1. The GFSC may impose conditions (subject to the statutory process) when approving a change of control where (a) if it did not impose those conditions, it would propose to object to the acquisition or (b) it appears to the GFSC that imposing those conditions is desirable in order to advance one or more of its regulatory objectives. 5.2. By way of example, the GFSC may impose conditions on an approval where there are unresolved matters, such as outstanding proceedings against a proposed controller.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 28 Annex 1 – Practical examples of the determination of controllers These diagrams are used to demonstrate how the controller test applies. These diagrams do not aim to conclude all control chains to where control, as per the FSA, ends (i.e. the red boxes). Diagram B This example emphasises the impact of voting power in any determination as to whether there is a controlled undertaking (and thus deemed voting). Note that shareholding and voting power are separate calculations.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 29 Diagram C (all % represent shares and voting)

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 30 Diagram D (all % represent shares and voting)

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 31 Diagram E (all % represent shares and voting) This diagram demonstrates that acting in concert does not apply for the purpose of determining whether an undertaking controls another for the purpose of deemed voting (point (a)(v) of the definition of voting power in s107(1) of the FSA). See paragraphs 2.31 and 2.32.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 32 Diagram F (all % represent shares and voting)

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 33 Diagram G (all & represent shares and voting)

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 34 Annex 2 – Further guidance on acting in concert and deemed voting power Deemed voting power

1. There may be circumstances in which deemed voting power must be aggregated with other (actual or deemed) voting power for the purposes of determining whether s114(2)(b) of the FSA applies.
2. The cases set out in paragraph (a) of the definition of ‘voting power’ in s107(1) of the FSA may result in the attribution of voting power to a person (‘H’) without aggregation where H holds no other actual or deemed voting power in the relevant firm and is not acting in concert with any other person, for example, where H exercises the voting power attaching to shares deposited with H pursuant to a discretion granted to H in the absence of: a) specific instructions from the actual shareholders; and b) any agreement with the shareholders as to how H should exercise that voting power or any other rights attached to those shares.
3. The GFSC would not generally regard shareholders as acting in concert for the purposes of s111(2) of the FSA or as having deemed voting power requiring aggregation pursuant to the definition of ‘voting power’ in s107 of the FSA simply because they have agreed to vote together on a particular issue, for example: a) rejection of a proposal for the remuneration of directors; b) appointment or removal of a particular director; or c) approval or rejection of an acquisition or disposal proposed by the firm’s board of directors.
4. There may be circumstances in which voting together on a specific issue would amount to acting in concert for these purposes. Where, for example, shareholders who have no previous agreement in relation to the exercise of their voting rights agree to act together for the purpose of voting to enable them to obtain control of the board of a firm. This may not fall within the definition of voting power in s107(1) of the FSA, if those shareholders have no lasting common policy towards the firm’s management. However, these circumstances are likely to be exceptional.
5. An agreement that does no more than require particular management actions to be put to a vote of shareholders, such as major acquisitions, disposals or new issues of shares, would not in and of itself trigger the requirement to notify. This is because there is no agreement as to how the shareholders will exercise their rights on, or whether the shareholders will adopt a common policy towards, those proposals.
6. An agreement that gives certain shareholders veto rights over key decisions by the firm may bring those shareholders within the ambit of s111(1) of the FSA, regardless of whether they are acting in concert by virtue of their being able to exercise significant influence over the management of the firm.
7. Acting in concert covers all agreements as to how to exercise voting power on future issues generally. It would, therefore, require the aggregation of holdings by the parties to the agreement, for the purposes of s111 of the FSA. It may also fall within the ambit of the definition of voting power in s107(1) of the FSA, but this will depend on whether the parties to the agreement have adopted a lasting common policy that relates to the management of the relevant firm.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 35 Passive shareholder agreements 8. The GFSC considers that acting in concert may also arise as a result of passive shareholder agreements. In these, a shareholder (the passive shareholder) agrees explicitly or implicitly with another shareholder or group of shareholders (the ‘active shareholder’) that it will not exercise its voting power. 9. For example, where the passive shareholder holds 2% of the voting power and the active shareholder holds 9% of the voting power, each would be regarded as having control (11% of the voting power) because their holdings are required to be aggregated under the acting in concert provisions. 10. However, persons that acquire shares as part of an investment or hedging programme, and adhere consistently to a stated policy of not voting those shares, would not be regarded by the GFSC as having entered into an agreement with other shareholders, and would not be regarded as acting in concert with them. 11. There may be circumstances where multiple purchasers of shares, who are each party to a share purchase agreement and whose combined shareholding will fall within s114(2) of the FSA, are required to give notice pursuant to s111(1) of the FSA, on the basis that the existence of the agreement means they are acting in concert. 12. If it is clear that the only agreement between one or more persons consists in there being parties to the same share purchase agreement, and the terms which relate strictly to the purchase of shares and do not govern or seek to regulate the purchasers’ relationship with each other following completion of the share purchase, the purchasers would not be regarded by the GFSC as acting in concert for the purpose of requiring notification under s111 of the FSA. 13. If, however, the share purchase agreement contains provisions governing or otherwise regulating the exercise of the rights linked to the shares to be acquired by the purchasers (or the purchasers have entered into, or propose to enter into, a shareholders’ or other agreement with similar effect), the proposed controllers may be regarded by the GFSC to be acting in concert as per s111 of the FSA, depending on the terms of the relevant agreement(s). 14. Where there is evidence to suggest that the parties do in fact intend to co-operate in relation to the exercise of voting or other rights relating to the shares they are acquiring, notwithstanding that no provisions to that effect appear in the share purchase or other written agreement, this may warrant the conclusion that there is an implicit agreement between them by virtue of which they are acting in concert. Shareholder cooperation 15. The GFSC does not intend to apply the Change of Control regime in a way that inhibits cooperation between shareholders where such cooperation is aimed at exercising good corporate governance.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 36 16. When determining whether cooperating shareholders are acting in concert, the GFSC will carry out a case-by-case analysis and assess each case on its own merits. The GFSC considers the following non￾exhaustive list of facts to indicate shareholder cooperation: a) entering into discussions with each other about possible matters to be raised with the company’s management body; b) making representations to the company’s management body about company policies, practices or particular actions that the company might consider taking; c) other than in relation to the appointment of members of the management body, exercising shareholders’ statutory rights to: i) add items to the agenda of a general meeting: ii) table draft resolutions for items included or to be included on the agenda of a general meeting; or iii) call a general meeting, other than the annual general meeting; d) other than in relation to a resolution for the appointment of members of the management body and, in so far as such a resolution is provided for under Gibraltar law, agreeing to vote in the same way on a particular resolution put to a general meeting, in order, for example: i) to approve or reject: • a proposal relating to directors’ remuneration; • an acquisition or disposal of assets; • a reduction of capital and/or share buy-back; • a capital increase; • a dividend distribution; • the appointment, removal or remuneration of auditors; • the appointment of a special investigator; viii. the company’s financial statements; or • the company’s policy in relation to the environment or any other matter relating to social responsibility or compliance with recognised standards or codes of conduct; or ii) to reject a related party transaction. 17. The GFSC will not consider shareholder engagement or cooperation in any of the activities listed in paragraph 16, on its own, to amount to acting in concert. If shareholders cooperate in ways not listed in paragraph 16, that fact alone will also not be sufficient to conclude they are acting in concert. However, if there are additional facts on a particular occasion which indicate that the shareholders should be regarded as persons acting in concert, the GFSC will take those facts into account in making its determination. There may, for example, be facts about the relationship between the shareholders, their objectives, their actions or the results of their actions which suggest that their cooperation in relation to an activity contemplated in paragraph 16 is not merely an expression of a common approach on a specific matter, but one element of a broader agreement or understanding between the shareholders.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 37 18. When considering cases of cooperation between shareholders in relation to the appointment of members of the management body, the GFSC will, in addition to examining the facts described in paragraph 16 (including the relationship between the relevant shareholders and their actions), also consider other facts such as: a) the nature of the relationship between the shareholders and the proposed member(s) of the management body; (b) the number of proposed members of the management body being voted for pursuant to a voting agreement; (c) whether the shareholders have cooperated in relation to the appointment of members of the management body on more than one occasion; (d) whether the shareholders are not simply voting together but are also jointly proposing a resolution for the appointment of certain members of the management body; and (e) whether the appointment of the proposed member(s) of the management body will lead to a shift in the balance of power in such management body. Conditional agreements 19. Where an agreement is conditional on any necessary approval by the GFSC, notice must be given under s111(1) of the FSA before control is acquired. The point in time at which this occurs may depend on a number of circumstances. In the context of a share purchase agreement that provides for the GFSC’s approval of the purchaser to be obtained before the acquisition is completed, the purchaser will not usually be required to give a section 111(1) notice prior to entering into the agreement. 20. However, there may be circumstances in which control is acquired at the time the agreement is entered into, for example, where the parties have agreed that the purchaser will be entitled (whether by virtue of a power of attorney contained in the agreement or otherwise) to exercise the voting rights attached to the shares being acquired in the period between signing and completion. In that case, the purchaser will need to consider whether to give notice under s111(1) of the FSA prior to entering into the agreement. Pre-emption rights, drag along rights and tag along rights 21. ‘Pre-emption’ rights, ‘drag along’ rights and ‘tag along’ rights are unlikely to trigger the requirement to notify under s111(1) of the FSA. Bare pre-emption rights will simply indicate each shareholder’s (the offeror) agreement to give fellow shareholders an option to purchase these shares, if they wish to sell. The acquisition of shares under these arrangements cannot take place until the offeror decides to sell these shares and other shareholders decide to buy them. 22. Shareholders will not usually be regarded as acting in concert in holding or acquiring shares simply by agreeing to give each other future pre-emption rights. 23. The existence of 'drag along' and 'tag along' rights in a shareholders' agreement (designed to ensure equivalent treatment of shareholders of the same class in the event an offer is made, or to be made, by a non-shareholder to purchase the shares of any single shareholder in a private company) would not result in the shareholders who have the benefit of those rights being considered as acting in concert in their holding or acquiring of shares.

Gibraltar Financial Services Commission Guidance Note – Assessment of Acquisitions and Increases in Control 38 Part 20 definition of acting in concert 24. The definition of ‘acting in concert’ set out in s387 of the FSA applies only to Part 20 of the FSA. The information in this Guidance Note is given for a different purpose and has no relevance to how ‘acting in concert’ is to be interpreted in the context of Part 20 of the FSA. Instead, the information in this Guidance Note is relevant to considering whether the holdings of persons who have reached an agreement in relation to the shares or voting rights they currently hold, or will hold, must be aggregated. This aggregation is necessary for the purpose of determining whether they are subject to the requirements for assessment specified in Part 9 of the FSA.

Published by: Gibraltar Financial Services Commission PO Box 940 Suite 3, Ground Floor Atlantic Suites Europort Avenue Gibraltar www.gfsc.gi © 2026 Gibraltar Financial Services Commission