Fact sheet on the assessment of key function holders at banks and (mixed) financial holding companies

Factsheet

Now that Directive (EU) 2024/1619 (CRD6) has been implemented in the Netherlands, the national assessment regime for second-tier management officials at banks has been superseded by a harmonised European assessment framework for key function holders. All key function holders must be of sufficiently good repute, act with honesty, integrity and independence of mind and possess sufficient knowledge, skills and experience to perform their duties. Banks are primarily responsible for assessing this. The new rules also apply to (mixed) financial holding companies which have been granted approval under Section 3:280a of the Financial Supervision Act (Wet op het financieel toezicht – Wft), and which are explicitly subject to these requirements pursuant to CRD6.1 External assessment by DNB or the ECB is limited to the heads of the internal control functions and the chief financial officer, and applies only to large institutions as referred to in Article 91a(5) of the CRD.

Published: 22 September 2026

Latest update: 29 September 2026

The CRD6 provisions concerning the fit-and-proper assessment framework of key function holders have been implemented in the Financial Supervision Act (Wet op het financieel toezicht – Wft) and the Decree on Prudential Rules for Financial Undertakings (Besluit prudentiële regels Wft – Bpr) The new rules entered into force on 22 September 2026.

Who are key function holders?

Section 1:1 of the Wft sets out, by reference to the definition provided in Article 3(1)(9a) of the CRD, who are to be regarded as a key function holders. They are the persons who have significant influence over the direction of a bank, a financial holding company or a mixed financial holding company but are not members of the management body, including the heads of internal control functions and the chief financial officer, if they are not members of the management body. For banks, this definition replaces the former national ‘second tier’ insofar as it relates to fitness and propriety or their assessment.

Internal assessment by banks and (mixed) financial holding companies

Pursuant to Section 3:9b(1) of the Wft, banks must ensure that key function holders are suitable for their roles and that their integrity is beyond doubt. This also applies to approved (mixed) financial holding companies as referred to in Section 3:280a of the Wft, as Section 3:272a of the Wft stipulates that Section 3:9b of the Wft applies to them mutatis mutandis.2 Banks and (mixed) financial holding companies must comply with these requirements by putting appropriate processes in place, in accordance with Article 91a(1-4) of the CRD. These provisions relate, among other things, to the timing of the assessment, the measures to be taken if the assessment requirements are not met, and the up-to-date nature and availability of information regarding suitability and integrity. As part of its regular supervisory activities, DNB may assess how banks and (mixed) financial holding companies fulfil this responsibility and may request further information.

Scope of external assessments by DNB or the ECB

Pursuant to Section 33(1)(d) of the Bpr, the external assessments by DNB or the ECB of key function holders is limited to a specific group, namely the heads of internal control functions and the chief financial officers employed by large institutions as referred to in Article 91a(5) of the CRD. Whether these assessments are carried out by DNB or the ECB depends on whether a bank is classified as less significant or significant. DNB is the competent authority for less significant banks, while the ECB is the competent authority for significant banks.3 Whether external assessment is required at all also depends on whether the institution in question is a large institution as defined in Article 91a(5) of the CRD (see below under ‘Assessment by DNB or the ECB applies only to large institutions’). External assessments cover both the integrity and the suitability of these staff members.4

Internal control functions means risk management, compliance and internal audit functions.5 The heads of the internal control functions means the persons at the highest hierarchical level responsible for effectively managing the day-to-day operation of those functions.6 The chief financial officer means the person with overall responsibility for the financial resources management, financial planning and financial reporting.7

If the head of an internal control function or the chief financial officer is also a member of the management body, the assessment regime for members of the management body applies. In such a case, responsibility for the internal control function or the finance function, respectively, is explicitly taken into account in the assessment.

Assessment by DNB or ECB applies only to large institutions

Furthermore, pursuant to Section 33(1)(d) of the Bpr, external assessments by DNB or the ECB of the heads of the internal control functions and the chief financial officer is limited to large institutions as referred to in Article 91a(5) of the CRD. This applies to banks (or their subsidiaries) that qualify as large institutions, as well as (mixed) financial (EU) parent holding companies whose group includes a large institution. Multiple entities may qualify as a large institution within a group. The following are classified as large institutions: global systemically important institutions (GSIs), other systemically important institutions (OSIs), one of the three largest institutions in a Member State, and institutions with total assets of €30 billion or more on an individual or consolidated basis.8 On a consolidated basis also means on a sub-consolidated basis. This means that institutions which, on an individual basis, do not have total assets of €30 billion or more may nevertheless qualify as large institutions if they meet this threshold on the basis of the (sub-)consolidated financial position of the parent institution, financial parent holding company or mixed financial parent holding company.9

Please note that the concept of a ‘large institution’ within the meaning of the CRR is not the same as that of a ‘significant institution’ (SI) within the Single Supervisory Mechanism (SSM). Although the criteria overlap to some extent, the CRR and the SSM framework have separate criteria for these classifications.10 An institution may therefore qualify as a large institution without being an SI, and vice versa. For the purposes of Article 91a(5) of the CRD, the decisive factor is whether the institution qualifies as a large institution within the meaning of the CRR.

What does this mean for banks and (mixed) financial holding companies?

DNB expects banks and (mixed) financial holding companies to comply with the requirements for key function holders from the date of implementation of CRD6.

As a minimum, this means they must:

have adequate internal processes in place to assess all key function holders for suitability and integrity, as laid down in the Wft and CRD6;
effectively carry out internal assessments of all functions subject to the internal assessment requirement, even if these functions are not subject to external assessment by DNB or the ECB;
ensure that information regarding the suitability and integrity of key function holders is up to date, available and properly documented;
submit an application for assessment to DNB or the ECB, as appropriate, in good time prior to appointing a key function holder who is subject to external assessment (the heads of internal control functions or the chief financial officer at a large institution), ensuring that the required information and forms are submitted in full and correctly so that DNB and/or the ECB can assess their integrity and suitability.

Footnotes

[1] References to ‘(mixed) financial holding companies’ in this fact sheet relate exclusively to financial holding companies and mixed financial holding companies that fall within the scope of the CRD framework and have been granted approval in accordance with Article 21a of the CRD. Section 3:280a of the Wft implements Article 21a of the CRD.

[2] Section 3:272a of the Wft has been inserted to declare Section 3:9b of the Wft to apply mutatis mutandis to (mixed) financial holding companies, as these companies now fall within the scope of Article 91 of the CRD. This follows from Article 91(1) of the CRD, as amended.

[3] For further information, see: European law and SSM consequences

[4] This differs from the second-tier regime, under which DNB carried out integrity assessments for all second-tier functions. Suitability assessments were carried out primarily by banks themselves and shared with DNB. DNB carried out additional suitability assessments where there was cause to do so.

[5] Article 3(1)(9b) of CRD6.

[6] Article 3(1)(9c) of the CRD6, as implemented in Section 1:1 of the Wft.

[7] Article 3(1)(9d) of the CRD6, as implemented in Section 1:1 of the Wft.

[8] See the definition in Article 4(1)(146) of the CRR.

[9] See Article 4(1)(49) in conjunction with Article 4(1)(1) of the CRR.

[10] See ECB criteria for significant institutions.

Discover related articles

Factsheet

Share on LinkedIn Share on X Share on Facebook [Share via Email](mailto:?subject=I want to share this page with you&body=Take a look at this page of De Nederlandsche Bank: https://www.dnb.nl/en/sector-information/open-book-supervision/open-book-supervision-themes/fit-and-proper-assessments/second-echelon/fact-sheet-on-the-assessment-of-key-function-holders-at-banks-and-mixed-financial-holding-companies/.)

Necessary cookies

To ensure the proper operation of the website, De Nederlandsche Bank (DNB) uses functional cookies and analytics cookies, and has taken measures to ensure that these cookies have little or no impact on the privacy of website users.

Optional cookies

Some pages include embedded content from external websites. These websites may use proprietary (tracking) cookies. This allows third parties to track visitor statistics, show personalised content and display targeted ads, for example.
You can make your choice about allowing these optional cookies both when you first visit the website and when you navigate to a page with embedded content.