EBA/GL/2021/12
11 November 2021

EBA EUROPEAN BANKING AUTHORITY

Final Report

On Guidelines on a common assessment methodology for granting authorisation as a credit institution under Article 8(5) of Directive 2013/36/EU

Contents

Executive Summary 3

Background and rationale 5

Guidelines on a common assessment methodology for granting authorisation as a credit institution under Article 8(5) of Directive 2013/36/EU 7

1. Compliance and reporting obligations 9

2. Subject matter, scope and definitions 10

3. Implementation 11

4. General principles 12

4.1Common assessment methodology 12

4.2Consistency and continuity between the authorisation and the going-concern supervisory assessment 14

4.3Situations where an authorisation is required 17

5. Authorisation as credit institution under letter (a), point (1) of Article 4(1) CRR and its scope 19

5.1Activities requiring the application for an authorisation 19

5.2Scope of the authorisation 21

6. CAM for authorisation as credit institution under letter (b) of point (1) of Article 4(1) CRR 23

7. Business plan analysis 25

7.1General criteria 25

7.2Assessment methodology 25

8. Capital 35

8.1General criteria 35

8.2Determination of the level of the capital 35

8.3Quality, payment and availability of capital 37

9. Internal governance 39

9.1General criteria 39

9.2Management body 40

9.3Organisational structure 43

9.4Internal control framework 46

10. Qualifying holdings and members 53

Annex – Figures on determination of capital at authorisation and amount to be paid up 54

11. Accompanying documents 57

11.1 Draft cost-benefit analysis 57

11.2Overview of questions for consultation 63

11.3 Views of the Banking Stakeholder Group (BSG) 63

11.4 Feedback on the public consultation and on the opinion of the BSG 64

11.5 Summary of key issues and the EBA’s response. 64

Executive Summary

Access to an integrated internal market for financial services postulates that newcomers are subject to the same assessment methodology as regards compliance with authorisation requirements. With a view to fostering convergence of supervisory practices across the EU, the EBA – in accordance with the mandate set out in Article 8(5) CRD, introduced by Directive (EU) 2019/878 – has developed these draft guidelines ‘to specify a common assessment methodology for granting authorisations in accordance with this Directive’. The Guidelines lay down a common assessment methodology (‘CAM’) to be used by competent authorities throughout the EU for the purposes of granting authorisation as a credit institution.

The Guidelines apply to applicant credit institutions covered by both letters (a) and (b) of point (1) of Article 4(1) CRR as amended by Regulation 2019/2033/EU on investment firms. With specific regard to applicant credit institutions meeting one of the conditions set out in point (1), letter (b), (i) – (iii) , of Article 4(1) CRR, the Guidelines make clear that they also apply to these undertakings to the extent relevant, by taking into account the specificities of the applicant, in particular in the case of reauthorisation of investment firms, and without prejudice to the performance of specific assessments of these entities having regard to differences in the business model.

The Guidelines cover the authorisation requirements set out in the EU legal framework, namely in Articles 10–14 CRD relating to the programme of operations, the operational structure, the capital requirements, the effective direction, the shareholders and members, and the assessment of qualifying holdings.

From a methodological perspective, the Guidelines:

• are aligned with the RTS on information for authorisation1 ;

• advocate a risk-based approach;

• pursue the principle of proportionality for all relevant assessment criteria;

• confirm their neutrality to technology and thus apply to both traditional and innovative business models and/or delivery mechanisms;

• underscore the importance of consistency with the supervisory approaches applied to going concerns.

The Guidelines are in line with recent legislative developments, including the specific focus on the need for the applicant to demonstrate sound and effective risk management pursuant to Article 10 (2) CRD. Finally, the Guidelines also expressly include guidance regarding the ML/TF risk as part of the risks to be considered in the context of the assessment of the application for granting authorisation, along with the importance of cooperation with the AML supervisor and other public bodies as appropriate in accordance with Article 117(5) CRD.

The CAM laid down in the Guidelines aims to ensure the sound and prudent management of the credit institution as of the first day of access to the market. Within that context, it is clarified that,

[1] See EBA/RTS/2017/08 and EBA/ITS/2017/05/ of 14 July 2017. Both RTS and ITS are available at https://eba.europa.eu/regulation-and-policy/other-topics/rts-and-its-on-the-authorisation-of-credit-institutions

whilst all authorisation requirements have to be met for granting authorisation, competent authorities may impose conditions precedent, obligations subsequent, and restrictions, and may specify their supervisory expectations at the time of the authorisation provided the conditions set out in the Guidelines are met.

The Guidelines draw attention to the importance of the authorisation and the related supervisory activity being focused on those entities the purpose of which is to truly carry on the business as credit institutions, and to this end also clarify cases, e.g. business restructuring, where authorisation is needed.

In order to foster convergence as to the assessment of the business plan, the Guidelines lay down a thorough and comprehensive methodology which will support the competent authorities’ comprehensive understanding of the business model, the risk profile, the geographical distribution of the activities, and the viability and sustainability of the credit institution business undertaking, and will form the basis for the determination of the capital at authorisation and further prudential requirements.

Similarly, the Guidelines underscore the importance of the organisational structure, internal governance framework and control being commensurate with the business plan, so to ensure that the credit institution will be able to perform the targeted activities in a sound and prudent manner. In order to assess compliance with the internal governance requirements, the CAM provides guidance on the main elements and aspects to be assessed. The Guidelines clarify that this is without prejudice to the application of additional parts of the relevant applicable regulatory sources 2 and specify that the competent authorities’ assessment should aim at ensuring the compliance of the credit institution with the referred regulatory sources.

Lastly, pursuant to Article 14(1) CRD the Guidelines cover the assessment of shareholders and members, and the assessment of holders of qualifying holdings in accordance with the criteria set out in Article 23 CRD, as further specified in the ESAs’ Joint Guidelines on the prudential assessment of qualifying holdings3 .

[2] These include the EBA Guidelines on internal governance (EBA/GL/2021/05 of 2 July 2021, available at https://www.eba.europa.eu/guidelines-internal-governance-second-revision ); the EBA and ESMA Guidelines on the assessment of the suitability of members of the management body and key function holders (revised) (EBA/GL/2021/06, available at EBA/GL/2021/06, https://www.eba.europa.eu/joint-esma-and-eba-guidelines-assessment-suitability-members-management-body-revised ); the EBA Guidelines on sound remuneration policies (EBA/GL/2021/04 of 2 July 2021, available at https://www.eba.europa.eu/regulation-and-policy/remuneration/guidelines-on-sound-remuneration-policies-second-revision ); the EBA Guidelines on outsourcing arrangements (EBA GL/2019/02 of 25 February 2019, available at https://eba.europa.eu/regulation-and-policy/internal-governance/guidelines-on-outsourcing-arrangements); the EBA Guidelines on ICT and security risk management (EBA/GL/2019/04 of 29 November 2019, available at https://eba.europa.eu/regulation-and-policy/internal-governance/guidelines-on-ict-and-security-risk-management).

[3] JC/GL/2016/01 of 20 December 2016, available at https://esas-joint-committee.europa.eu/Publications/Guidelines/JC_QH_GLs_EN.pdf

FINAL PAPER ON GL ON A COMMON ASSESSMENT METHODOLOGY FOR GRANTING AUTHORISATION AS A CREDIT INSTITUTION

Background and rationale

By entrusting the EBA with the development of Guidelines to develop a common assessment methodology for granting authorisations, the EU legislator focuses on the importance of ensuring convergence of practices with regard to market access. A level playing field for new entrants is crucial to ensure comparability of institutions and effectiveness of the application of the Single Rulebook.

The mandate enshrined in Article 8(5) CRD is therefore a further move towards harmonisation of the EU regulatory framework on market access and builds upon previous pieces of regulation developed by the EBA. Reference is made to the draft RTS on the information to be submitted to the competent authority for authorisation as credit institutions (‘draft RTS on information for authorisation’), and the draft ITS on standard forms, templates and procedures for the provision of such information, which have been submitted to the European Commission 4 . Whilst not yet endorsed by the European Commission, the harmonisation provided by the draft RTS on information for authorisation has so far already defined a significant step forward in the convergence of supervisory practices.

The mandate set out in Article 8(5) CRD therefore marks a significant advance since it aims to harmonise how the elements and information submitted with the application are reviewed and assessed by the competent authority. Along these lines it provides a level playing field for the equal determination across the EU of the prudential requirements – capital, liquidity, organisational structure, governance, effective direction, shareholders and members – to be applied to the granting of authorisation to the applicant credit institution.

The combination of such pieces of Level 2 regulation relating to the granting of authorisation as a credit institution also significantly contributes to supporting the tasks of the ECB, which, in the context of the Single Supervisory Mechanism (SSM), is exclusively empowered to grant the authorisation to both significant and less significant credit institutions. In turn, practices developed by the ECB in the context of licensing since taking up the function of single supervisor5 have meaningfully contributed to the convergence of assessment practices within the Banking Union and have been duly taken into account in the course of the development of these Guidelines.

These Guidelines take a risk-based approach and take into account the principle of proportionality. They also underscore the importance of regulatory consistency and regulatory continuity throughout the lifecycle of the credit institution and endorse a common assessment methodology which is in line with the supervisory approach applied to going concerns. For these reasons, several existing regulatory guidelines have been taken into account for the development of these Guidelines, including those on internal governance, outsourcing, ICT security and risk management, remuneration, suitability assessment of members of the management body and prudential assessment of qualifying holdings.

[4] See EBA/RTS/2017/08 and EBA/ITS/2017/05/ of 14 July 2017. Both RTS and ITS are available at https://eba.europa.eu/regulation-and-policy/other-topics/rts-and-its-on-the-authorisation-of-credit-institutions

[5] See also ECB, Guide to assessments of licence applications, second revised edition, January 2019, available at https://www.bankingsupervision.europa.eu/ecb/pub/pdf/ssm.201901_guide_assessment_credit_inst_licensing_appl.en.pd f, and ECB, Guide to assessments of fintech credit institution licence applications, September 2017, available at https://www.bankingsupervision.europa.eu/legalframework/publiccons/pdf/licensing_and_fintech/ssm.guide_on_assessm ent_for_licensing_of_fintech_credit_insts_draft.en.pdf

FINAL PAPER ON GL ON A COMMON ASSESSMENT METHODOLOGY FOR GRANTING AUTHORISATION AS A CREDIT INSTITUTION

In line with legislative developments to protect the integrity of the financial system from financial crime, ML/TF risk, as part of the risks to be considered in the context of the assessment of the application for granting authorisation (e.g. business model analysis, origin of the sources of funding), is also duly included in the current draft Guidelines along with the importance of cooperation with the AML supervisor and other public bodies as appropriate in accordance with Article 117(5) CRD. The importance of tackling ML/TF risk is also underscored in the part relating to internal governance.

As regards the notion of credit institution laid down in point (1), letter (a) of Article 4(1) of the CRR, several elements of its definition would benefit from further clarification by the legislator, as brought to the European Commission’s attention on previous occasions by the EBA in the context of advice provided in relation to the CRD regulatory perimeter 6, and more recently by the adoption of the Opinion on elements of the definition of credit institution under point (1), letter (a) of Article 4(1) CRR and on aspects of the scope of the authorisation7 . Without prejudice to any further harmonisation that will be set out in level 1 texts, these Guidelines limit themselves to laying down some core aspects of the elements of the definition of a credit institution contained in the CRR in line with the conclusions reached by the EBA in previous Reports8 .

To comprehensively fulfil the mandate, the Guidelines also lay down guidance on the common assessment for granting authorisation as a credit institution contemplated by point (1), letter (b), of Article 4(1) CRR, as amended by Regulation 2019/2033/EU on investment firms. Considering that such entities are subject to at least the same authorisation requirements set out in Articles 10–14 CRD for credit institutions covered by point (1), letter (a) of Article 4(1) CRR, the Guidelines provide that the CAM also applies to such applicants to the extent possible, having regard to their specific features.

[6] See the EBA Report on the perimeter of credit institutions established in the Member States and the related Opinion (EBA/Op/2014/12) of 27 November 2014, available at https://eba.europa.eu/ebapublishes-an-opinion-on-the-perimeter-of-credit-institutions ; and the EBA Report on other financial intermediaries and regulatory perimeter issues and the related Opinion (EBA/Op/2017/13) of 9 November 2017, available at https://eba.europa.eu/ebapublishes-an-opinion-and-report-on-regulatory-perimeter-issues-relating-to-the-crdiv-crr

[7] EBA/OP/2020/15 of 18 September 2020, available at https://eba.europa.eu/eba-flags-eu-commission-elements-definition-credit-institution-and-aspects-scope-authorisation

[8] See in particular the EBA Report on the perimeter of credit institutions established in the Member States.

EBA EUROPEAN BANKING AUTHORITY

Guidelines on a common assessment methodology for granting authorisation as a credit institution under Article 8(5) of Directive 2013/36/EU

EBA/GL/2021/12
11 November 2021

Guidelines

on a common assessment methodology for granting authorisation as a credit institution under Article 8(5) of Directive 2013/36/EU

1. Compliance and reporting obligations

Status of these Guidelines

1. This document contains Guidelines issued pursuant to Article 16 of Regulation (EU) No 1093/20109 . In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities and financial institutions must make every effort to comply with the Guidelines.

2. Guidelines set out the EBA view of appropriate supervisory practices within the European System of Financial Supervision or of how Union law should be applied in a particular area. Competent authorities as defined in Article 4(2) of Regulation (EU) No 1093/2010 to which Guidelines apply should comply by incorporating them into their practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where Guidelines are directed primarily at institutions.

Reporting requirements

3. According to Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must notify the EBA as to whether they comply or intend to comply with these Guidelines, or otherwise provide reasons for non-compliance, by 08.04.2022. In the absence of any notification by this deadline, competent authorities will be considered by the EBA to be non-compliant. Notifications should be sent by submitting the form available on the EBA website to compliance@eba.europa.eu with the reference ‘EBA/GL/2021/12’. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities. Any change in the status of compliance must also be reported to the EBA.

4. Notifications will be published on the EBA website, in line with Article 16(3).

[9] Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC, (OJ L 331, 15.12.2010, p.12).

2. Subject matter, scope and definitions

Subject matter

5. These Guidelines specify a common assessment methodology (‘CAM’) for granting authorisations in accordance with Directive 2013/36/EU (‘CRD’), in pursuance of the mandate conferred on the EBA by Article 8(5) of that Directive as amended by Directive (EU) 2019/878.

Scope of application

6. These Guidelines apply to all cases where, in accordance with Directive 2013/36/EU, as subsequently amended, competent authorities have to assess the granting of an authorisation as a credit institution – defined in letters (a) and (b) of point (1) of Article 4(1) of Regulation (EU) No 575/201310 (‘CRR’).

Addressees

7. These Guidelines are addressed to competent authorities as defined in Article 4(2)(i) of Regulation (EU) No 1093/2010.

Definitions

8. Unless otherwise specified, terms used and defined in the CRR, in the CRD, in Regulation 2019/203311 on prudential regulation of investment firms and in Directive 2019/203412 on the supervision of investment firms have the same meaning in the Guidelines.

9. In addition, for the purposes of these Guidelines, the following definitions apply:

AML/CFT supervisor	The competent authority as defined Article 4(2)(iii) of Regulation (EU) No 1093/2010
CAM	Common assessment methodology

[10] As amended by Regulation 2019/2033/EU on the prudential regulation of investment firms.

[11] Regulation (EU) 2019/2033 of the European Parliament and of the Council of 27 November 2019 on the prudential requirements of investment firms and amending Regulations (EU) No 1093/2010, (EU) No 575/2013, (EU) No 600/2014 and (EU) No 806/2014

[12] Directive (EU) 2019/2034 of the European Parliament and of the Council of 27 November 2019 on the prudential supervision of investment firms and amending Directives 2002/87/EC, 2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU

3. Implementation

Date of application

10. These Guidelines apply from 08.04.2022.

4. General principles

4.1 Common assessment methodology

11. Competent authorities should ensure that for the purposes of granting an authorisation as a credit institution, as defined in Article 4(1) of CRR, they apply the common assessment methodology (‘CAM’) set out in these Guidelines.

12. The CAM lays down the criteria and methods according to which competent authorities should assess the common requirements for granting authorisation as a credit institution set out in Articles 10 to 14 of Directive 2013/36/EU.

13. For the purposes of these Guidelines, references to risk also include ML/TF risk. Competent authorities should therefore comprehensively assess AML/CFT-related aspects for the purposes of granting the authorisation. To this end, competent authorities should cooperate with the relevant AML/CFT supervisor and other relevant public bodies as appropriate in compliance with Article 117(5) of Directive 2013/36/EU13.

14. In order to ensure that the assessment for granting the authorisation is based on reliable information, competent authorities should review the information and documents submitted with the application pursuant to the RTS on information for authorisation, in light of the requirements of truthfulness, clarity, accuracy, up-to-dateness and completeness, and with a view to ensuring the sound and prudent management of the institution. Pursuant to Article 10(2) of the RTS on information for authorisation, competent authorities may also require the applicant to provide supplemental information or additional explanations.

15. The CAM is technology-neutral and innovation-friendly, therefore it covers applicant credit institutions with all business models, both traditional and innovative business models and/or delivery mechanisms and, at the same time, does not impose requirements to use specific technologies or adopt certain structures. Therefore, it does not hinder the emergence and scaling up of new technologies and innovative business models. Accordingly, competent authorities should not prefer or prevent the adoption of a specific technology, nor should they prefer or prejudice a specific business model or service in the context of the assessment of the application. This is without prejudice to the need to ensure that the business model or the delivery mechanism cannot pose an obstacle to the competent authorities’ effective supervision.

[13] In particular the EBA Guidelines on cooperation on and information exchange between prudential supervisors, AML/CFT supervisors and financial intelligence units under Directive 2013/36/EU. The Consultation Paper, EBA/CP/2021/21 of 27 May 2021, is available at https://www.eba.europa.eu/eba-consults-new-guidelines-cooperation-and-information-exchange-area-anti-money-laundering-and

16. In order to ensure a level playing field across the EU, competent authorities’ assessment should only be technical, reflect prudential regulation and be in accordance with Article 11 of Directive 2013/36/EU.

i. Proportionality

17. Competent authorities should perform the assessment for granting the authorisation in accordance with the principle of proportionality as specified in these Guidelines, with a view to ensuring that the assessment is consistent with the individual risk profile and business model of the applicant credit institution, so that the objectives of the regulatory requirements are effectively achieved.

18. For this purpose competent authorities should take into account the following criteria:

a) the expected size of the balance sheet of the applicant credit institution and its subsidiaries within the scope of prudential consolidation, as applicable;

b) the expected geographical presence of the applicant credit institution and the size of its operations in each jurisdiction;

c) the legal form of the applicant credit institution, including whether the credit institution is part of a group;

d) whether the institution is listed or not;

e) the type of planned activities and services performed by the applicant credit institution (e.g. see also Annex 1 to Directive 2013/36/EU and Annex 1 to Directive 2014/65/EU);

f) the business model (including its innovative character, uniqueness or complexity) and strategy, as well as the expected level of risk stemming from the implementation and execution; the nature and complexity of the targeted business activities;

g) the credit institution’s organisational structure;

h) the envisaged risk strategy, risk appetite and risk profile of the applicant credit institution;

i) the ownership and funding structure of the applicant credit institution;

j) the type of clients (e.g. retail, corporate, institutional, small businesses, public entities) and the complexity of the envisaged products or contracts;

k) the envisaged outsourced functions and distribution channels;

l) the existing and/or planned information technology (IT) systems, including continuity systems and outsourcing functions in this area;

m) whether the applicant credit institution belongs to a group which is subject to the consolidated supervision of the competent authority;

n) whether the applicant credit institution submits an application for specific activities only, or an existing credit institution applies for an extension of the scope of the authorisation whenever the authorisation has exclusively been granted for the exercise of specific activities;

o) the consistency with the type and breadth of information required pursuant to the RTS on information for authorisation.

19. In the case of paragraph 18, letter m), and in line with Article 10(1) of the RTS on information for authorisation, the intensity of the assessment should take into account the competent authority’s direct knowledge – based on information available to it – of the business model, risk profile and current prudential, financial, business and operational conditions of the applicant credit institution or group.

20. In the case of paragraph 18, letter n), provided the submitted extension does not materially alter the nature and risk profile of the credit institution, the competent authorities’ assessment should be limited in scope and focus on the impact of the new additional activities on the overall business model and on the capacity to comply with prudential requirements, in particular on the sound and prudent management of the credit institution (including, in particular, the profitability of the new business lines and the overall sustainability of the business plan, the suitability of the members of the management body in its management or supervisory function, the internal control framework and IT systems). It should also take into account the competent authority’s direct knowledge of the applicant credit institution’s business model, risk profile and current prudential, financial, business and operational conditions.

21. The application of the principle of proportionality by the competent authorities can never amount to exempting the applicant credit institution from the fulfilment of any mandatory requirements for granting the authorisation.

4.2 Consistency and continuity between the authorisation and the going-concern supervisory assessment

22. In accordance with the CAM, competent authorities should assess the application for authorisation as a credit institution consistently with the prudential requirements and the supervisory assessment methodologies applied in going concern. They should avoid assessment practices that promote contradictory approaches between the different phases of the credit institution’s lifecycle.

23. For this purpose, in order to avoid duplication and inconsistency of regulation, these Guidelines should be read in the light of the provisions of the legislative acts referred to in Article 1(2) of the EBA's founding Regulation, as well as the associated Delegated and Implementing acts, RTS, ITS, Guidelines and Recommendations, adopted under these legislative acts, which are relevant to the CAM, and cross-refer to them whenever appropriate and opportune.

24. Competent authorities’ assessment should focus on ensuring the sound and prudent management of the credit institution as of the first day of access to the market.

25. To ensure that this objective is met, competent authorities should only grant the authorisation when they are satisfied that all authorisation requirements are met. This notwithstanding, competent authorities should take into consideration the technical and operational adjustments that the credit institution might be subject to during its set-up phase. To ensure that these circumstances are duly taken into account, competent authorities may apply conditions precedent and/or obligations subsequent or restrictions, or clarify their expectations as to specific areas of supervisory focus in accordance with paragraphs 26–29 below.

26. Competent authorities may, at their own discretion, impose on the applicant credit institution conditions precedent and/or obligations subsequent at the time of issuance of the authorisation. The imposition of such conditions precedent and/or obligations subsequent should be subject to the competent authorities’ positive assessment that all requirements for granting the authorisation are met in substance and that they are satisfied with granting the authorisation. In order to ensure clarity and legal certainty, competent authorities should describe such conditions precedent and/or obligations subsequent clearly and well when applying them.

27. Consistently with paragraph 26, competent authorities may only apply conditions precedent relating to formal and non-substantive aspects of authorisation requirements, which in practice may only be satisfied by the applicant credit institution after the competent authority’s positive assessment of the fulfilment in substance of all authorisation requirements. By way of illustration, formal or non-substantive aspects of the authorisation requirements may include, depending on the circumstances, the submission of a piece of documentation formally adopted by the applicant, or the formal finalisation of a procedure internal to the applicant, or ICT system tests to check their full functioning in practice.

28. In accordance with the requirements and the limits set out in paragraphs 26 and 27, conditions precedent may be attached to the authorisation by the competent authorities in relation to matters where the applicant or the entity is required to undertake an action or to refrain from an action before the authorisation becomes effective. Competent authorities should set out a deadline for compliance and clearly indicate that the authorisation will only become effective once the condition has been fulfilled. So long as the condition is not fulfilled, the applicant credit institution cannot perform banking activities or use the name ‘bank’, ‘savings bank’ or other banking names.

29. Consistently with paragraph 26, competent authorities may impose obligations subsequent on the applicant credit institution in order to deal with matters occurring after the authorisation is granted. Such obligations subsequent may only be imposed by the competent authorities where, despite the applicant credit institution’s fulfilment of all the authorisation requirements in substance, compliance with one or more of them on an ongoing basis needs to be specifically monitored and enforced if warranted. Accordingly, competent authorities should clarify that, whilst failure to fulfil an obligation will not make the initial issuance of the authorisation ineffective per se, their non-compliance should be addressed by supervisory tools or result in the application of enforcement measures and/or sanctions. By way of example, obligations can be imposed in relation to matters which are considered to be implementing measures of the authorisation, such as reporting obligations or ensuring that members of the management body demonstrate adequate specific knowledge (e.g. undertaking training).

30. Without prejudice to the compliance with all the requirements for authorisation by the applicant credit institution, and subject to the positive assessment as to the granting of the authorisation, competent authorities, at their own discretion, may – at the time of the issuance of the authorisation – impose restrictions on the scope of some or all activities that the credit institution will be authorised to perform. Competent authorities may impose restrictions on some or all banking activities of the applicant credit institution in the same authorising document or separately from it. A restrictive undertaking of some or all banking activities by the applicant credit institution can either be put forward by the applicant credit institution in the application or may be the result of the comprehensive assessment by the competent authority.

31. In order to ensure clarity and legal certainty, competent authorities should clearly define such restrictions. By way of example, competent authorities may apply restrictions to the authorisation imposing a requirement to only take deposits up to a specific amount per depositor, or to only issue specific types of securities or to issue securities to only specific types of investors. The lifting of the applied restrictions should be subject to a proportionate assessment by the competent authority consistently with paragraph 18.

32. Subject to the meeting of all the requirements for granting the authorisation, competent authorities – at the moment of the issuance of the authorisation - may draw the attention of the applicant credit institution to specific areas of supervisory focus and illustrate their expectations in the same authorising document or separately from it. Competent authorities should provide reasons, and carefully set out the issue and the pursued objectives. The competent authority’s expectations, despite not being legally binding, should serve as guidance to the credit institution in going-concern.

33. Where the applicant credit institution belongs to a banking group and compliance with prudential requirements laid down in Parts Two to Eight CRR is required by the applicant credit institution or by its parent undertaking on the basis of their consolidated situation, competent authorities should review the analysis submitted by the applicant pursuant to Article 4, letter (f) of the RTS on information for authorisation, with a view to assessing its completeness and comprehensiveness. Where the competent authority is also the consolidated supervisor, it should also examine any effect on the applicable prudential requirements at consolidated level.

34. Competent authorities should identify the existence of any obstacles, having regard in particular to the existence of close links pursuant to Article 14(3) CRD, that could prevent the effective exercise of the supervisory functions, including, where applicable, on a consolidated basis, and consider any relevant information, circumstance or situation in accordance with Article 12 of the RTS on information for authorisation.

4.3 Situations where an authorisation is required

35. Competent authorities should ensure that in the case of a merger of two or more credit institutions entailing the incorporation of a new entity to take up the merged banking activities, such a newly established entity should be subject to the prior granting of authorisation by the competent authority. Similarly, in those Member States where the authorisation is granted on an activity-by-activity basis, competent authorities should ensure that the extension of the business activities, as a result of a merger by absorption of another credit institution or of a purchase of activities from a third-party credit institution, should be subject to a prior extension of the authorisation if such new business activities are not already covered by the authorisation issued to the credit institution.

36. The execution of group restructuring transactions or the transfer of activities as a credit institution from one entity to another may require carving certain activities out of the transaction and entrusting them to a newly established temporary entity, before those activities are merged into the acquiring credit institution.14

37. Where competent authorities assess that, by virtue of the activities that are temporarily transferred, such an entity fulfils the definition of a credit institution, that entity should be subject to prior authorisation.

38. Without prejudice to the paragraph above, competent authorities should not subject the transfer of the credit institution’s activities to a temporary entity to the granting of prior authorisation where the following conditions are met:

(a) the establishment of the temporary entity satisfies formal requirements of the structure for the execution of the transaction and the temporary credit institution’s expected lifetime corresponds to a ‘legal second’, i.e. an undefined short period of time during which the temporary entity holds the credit institution’s activities in order to formally complete a series of legal transactions that are required to merge the temporary entity with the acquirer, and

(b) adequate and sufficient measures have been taken by the merging entities to address the execution risks of the transaction, including for the scenario that the transfer cannot be completed within the ‘legal second’. Such measures (for instance a transfer back of the

[14] For example, the sale of a credit institution that is part of a group, while certain activities that require authorisation as a credit institution of the divested entity need to remain within the group. The activities which should remain can, for instance, be carved out into a new temporary legal entity and subsequently merged with another group entity that is authorised as a credit institution.

activities) should aim to ensure that the temporary entity is prevented from being active on the market by carrying out activities that require authorisation as a credit institution.

39. Competent authorities should clarify that an authorisation to carry on the business of a credit institution granted to a specific entity should only be used by that entity and should not be transferred to another entity.

40. Considering that the authorisation is granted by competent authorities under the applicable national law, where a credit institution intends to transfer its seat to another Member State the competent authorities should subject that relocation to the prior granting of the authorisation by the competent authority of the Member State where the credit institution’s new registered office will be located.

41. Consistently with the applicable national company law, an existing credit institution may change its legal form. Where the change of legal form does not entail material supervisory changes, competent authorities should not make the change conditional upon the granting of a new or amended authorisation.

5. Authorisation as credit institution under letter (a), point (1) of Article 4(1) CRR and its scope

5.1 Activities requiring the application for an authorisation

42. Pursuant to Directive 2013/36/EU, the protection of savings and of financial stability requires that the carrying out of the activity as a credit institution is subject to a prior authorisation by the competent authority that may only be granted further to the positive assessment of the application submitted by the applicant credit institution.

43. Competent authorities should assess that the applicant meets all the elements of the definition of a credit institution set out in point (1), letter (a) of Article 4(1) of CRR – ‘an undertaking the business of which is to take deposits or other repayable funds from the public and to grant credit for its own account’. In particular, they should assess that both the activity of ‘taking deposits or other repayable funds from the public’ and of ‘granting credit for its own account’ will be exercised by the applicant credit institution.

44. This is without prejudice to the possibility for a credit institution to carry out activities set out in Annex I CRD and in accordance with the national law. Competent authorities’ assessment of the business plan should therefore cover all the activities envisaged by the applicant credit institution in the programme of operations, including those that go beyond the taking of deposits or other repayable funds from the public and granting credit on own account, regardless of whether they are set out in Annex I CRD, or further activities pursuant to national law. Competent authorities should examine the consistency and correspondence between the envisaged activities and the internal organisation of the applicant, and the absence of elements that could prevent the effective exercise of their supervisory functions. Along these lines, competent authorities should clarify that, once authorised, the applicant credit institution will be subject to comprehensive scrutiny of all the activities carried out by the credit institution exclusively for the purposes of determining the impact of all such activities on the prudential regulation and supervision of the credit institution as a whole.

45. Where competent authorities assess that the business model of the applicant credit institution does not meet all the elements of the definition of a credit institution set out in point (1), letter (a) of Article 4(1) CRR, they shall refuse to grant the authorisation.

46. Absent a common EU notion of the elements composing the definition of a credit institution set out in point (1), letter (a) of Article 4(1) of CRR these Guidelines indicate to the competent authorities core aspects of such elements as well as areas requiring competent authorities’ special attention when assessing the application.

47. When assessing whether the expression ‘the business of which’ is met, competent authorities should assess that the combination of both activities of ‘taking deposits or other repayable funds from the public’ and ‘granting credit for its own account’ will be performed on a regular and systematic basis.

48. Pursuant to the general principle of protection of savings, when assessing whether the expression ‘”take” deposits or other repayable funds from the public’ is met, competent authorities should make sure, among other things, that the applicant credit institution’s business model (and thus its funding structure) covers receiving and/or holding such deposits and other repayable funds until repaid in full. Repayment in full relates to the principal amount with any accrued interests, if any.

49. When assessing whether the expression ‘deposits’ is met, competent authorities should focus their attention at least on ensuring that they are:

a. a sum of fiat currency in whatever form (such as coins, notes, scriptural money, etc.);

b. repayable on demand or at a contractually agreed point in time and with or without interest or a premium;

c. received from third parties (legal or natural persons);

d. received in the course of carrying on the activity by way of business.

50. Competent authorities should also note that deposits may take several forms, they may be transferable, or other deposits, including savings deposits, fixed-term deposits or non-negotiable certificates of deposit.

51. Competent authorities should also ensure, among other things, that the exclusions to the notion of eligible deposit and the repayment obligation by the deposit guarantee scheme asset out in Article 5(1) of Directive 2014/49/EU on deposit guarantee schemes(‘DGSD’) do not affect the notion of ‘deposits’ for the purposes of the granting of the authorisation as a credit institution.

52. When assessing whether the specific expression ‘other repayable funds’ is met, competent authorities should refer to ‘financial instruments which possess the intrinsic characteristic of repayability’ as well as ‘those which, although not possessing that characteristic, are the subject of a contractual agreement to repay the funds paid’ 15. They should also take into account that such a notion should include bonds and other comparable securities such as negotiable certificates (not nominative) of deposit, provided these are continually issued by the credit institution16.

[15] Court of Justice, 12 February 1999, C-199/97, Romanelli.

[16] Recital 14 CRD reads ‘The scope of measures should therefore be as broad as possible, covering all institutions whose business is to receive repayable funds from the public, whether in the form of deposits or in other forms such as the continuing issue of bonds and other comparable securities […]’ (emphasis added).

53. When assessing whether the deposits or other repayable funds are taken ‘from the ‘public’, competent authorities should focus in particular on whether ‘deposits or other repayable funds’ are received as a business from legal or natural persons other than the credit institution.

54. When assessing whether the expression ‘to grant credit’ is met, competent authorities should focus in particular on whether the applicant credit institution will conclude agreements for the provision of a sum of money for a specified or unspecified purpose, for a period of time to be agreed, and to be repaid in accordance with agreed conditions, usually providing for remuneration. With specific regard to the expression ‘for its own account’, competent authorities should assess whether the applicant credit institution envisages being the creditor of the granted financing.

55. As part of the assessment for granting the authorisation as a credit institution, competent authorities should also consider whether the granting of an authorisation as a credit institution is required by the underlying situation and current circumstances of the applicant credit institution. They should assess the adequacy and necessity of the authorisation as a credit institution, having regard to the activities that the applicant credit institution intends to carry out.

56. Where, based on the information submitted with the application, it is not completely clear that conducting business as a credit institution is the applicant credit institution’s actual business intention, competent authorities should increase the level of scrutiny of the application. This is particularly the case where they detect limited or formal compliance with the individual components of the definition of a credit institution.

In such circumstances competent authorities should examine the applicant credit institution’s possible additional business motives supporting the submission of the application, such as the benefits deriving from the status of credit institution in terms of reputation, access to payment and settlement systems and cheaper funding. Competent authorities should, among other things, put particular emphasis on the level of risk of the intended activities and the viability of the business model, having also regard, among other things, to the potential negative effects on the deposit guarantee schemes and the amount and quality of collateral stored at the central banks.

5.2 Scope of the authorisation

57. Absent a uniform scope of authorisation set out in EU law, different regimes may be in place at the national level. Accordingly, where ‘universal authorisation’ regimes are in place, the authorisation covers all the activities listed in Annex I CRD and in accordance with national law.

58. Conversely, where no such ‘universal authorisation’ is in place, the authorisation will be issued on an activity-by-activity basis and only cover the specific activities for which the authorisation is granted. In the latter case, competent authorities should update their assessment as to the scope of the previously issued authorisation whenever the credit institution applies to extend its business to activities which are not covered by the issued authorisation. Such an assessment should be performed consistently with the guidance set out in paragraph 20.

59. In both cases covered by paragraphs 57 and 58, however, the competent authorities’ scope of assessment should cover all the activities envisaged in the programme of operations.

6. CAM for authorisation as credit institution under letter (b) of point (1) of Article 4(1) CRR

60.In accordance with Article 8a CRD, undertakings meeting one of the conditions set out in point (1), letter (b), (i)-(iii) of Article 4(1) CRR have to apply for an authorisation as a credit institution.

61.For that purpose, the concerned undertakings have to submit an application to the competent authority in compliance with the information requirements set out in EBA RTS 2020/11 (information for authorisation under Article 8a(6)(a) CRD17).

62.Competent authorities should review such information in light of the requirements of truthfulness, clarity, accuracy and completeness and with a view to ensuring the sound and prudent management of the credit institution. Based on the assessment, they may also require supplemental information or clarification in accordance with Article 1(5) of EBA RTS 2020/11 (information for authorisation under Article 8a(6)(a) CRD).

63.To review and assess the application, competent authorities should apply all sections of these Guidelines to the extent relevant, having regard to the specific features of the applicant. This is without prejudice to the setting out in this section of additional assessment criteria that take into account the specificities of the applicant under point (1), letter (b) of Article 4(1) CRR.

64.With a view to streamlining the assessment in accordance with Article 8a(5) CRD, competent authorities should cooperate with the competent authority indicated in Article 67 of Directive 2014/65/EU (MiFID2). In particular, for the purposes of forming their own assessment on the applicant’s compliance with the conditions for authorisation as a credit institution, competent authorities should take into account the assessment provided by the competent authority indicated in Article 67 MiFID2, relating to the continuous compliance of the applicant with conditions for authorisation under MiFID.

65.Competent authorities should ensure that the applicant credit institution will be compliant with the applicable prudential requirements as of the first day of access to the market as an authorised credit institution. Competent authorities should therefore appropriately calibrate the intensity of their assessment in respect of those applicants which, prior to the application, were subject to prudential requirements other than those applicable to credit institutions.

66.For the purposes of the assessment of the business plan, competent authorities should apply the methodology laid down in section 7 to the extent applicable. Furthermore, they should take

[17] EBA RTS/2020/11 of 16 December 2020, Draft regulatory technical standards related to the implementation of a new prudential regime for investment firms on: - the information for the authorisation of credit institutions under point (a) of Article 8a(6) of Directive 2013/36/EU […]. https://eba.europa.eu/regulation-and-policy/investment-firms/regulatory-technical-standards-prudential-requirements-investment-firms

into account the specificities of the applicant credit institution’s business model, having regard in particular to the features of the revenue generating income model, funding structure and specific risks that such a business model is or might be exposed to.

7. Business plan analysis

7.1 General criteria

67. The competent authorities’ assessment of the business plan should be based on the relevant documents and information submitted by the applicant credit institution, in particular pursuant to Article 4, letters (a) to (h), and Article 5(1)(a) of the RTS on information for authorisation, focus on the applicant credit institution’s business model, strategy and risk profile, and aim to form a view on the viability and sustainability of its business model and its capacity to comply with prudential requirements within the planning horizon.

68. Consistently with paragraph 13, competent authorities should assess the exposure to ML/FT risks resulting from the applicant credit institution’s business plan. For this purpose, competent authorities should in particular assess whether the sectors, activities, products, target customers, geography and distribution channels present a higher level of ML/TF risk.

69. Consistently with the principles set out in paragraphs 15 and 16, competent authorities should refrain from indicating preferences for specific business models and be neutral as to the business needs of their jurisdiction.

70. Competent authorities should calibrate the intensity of their assessment in light of the proportionality criteria set out in paragraph 18.

71. As a general criterion, competent authorities should perform the qualitative and quantitative assessment of the business plan based on their expert judgment. To ensure equal treatment and internal consistency, expert judgment should be based on the criteria and the methodology laid down in these Guidelines, and in particular in this section 7.

72. Without prejudice to paragraph 71, in order to support the business plan assessment and to the extent that is appropriate and feasible, competent authorities may also conduct a peer comparison in accordance with the criteria laid down in paragraph 99.

73. To ensure supervisory continuity between the authorisation phase and ongoing supervision of the applicant credit institution, the analysis and the outcome of the assessment of the business plan performed for the purposes of the authorisation should be shared within the competent authority, including for the purpose of monitoring any mitigation measure, in the form of conditions precedent, obligations subsequent or restrictions as referred to in section 4.2, paragraphs 25–32, that the competent authority may have applied in the context of the assessment for granting the authorisation.

7.2 Assessment methodology

7.2.1 Business strategy

74. Competent authorities should undertake a qualitative review of the business strategy of the applicant credit institution in order to achieve an overview of the types of activities that it intends to take up, their geographical distribution, the credibility of the underlying assumptions and the associated risk profile of the applicant credit institution.

75. For this purpose, competent authorities should achieve a clear view on:

(a) the types of activities that the applicant credit institution intends to take up, including the identification of the core and non-core business lines and of the types of targeted customers. This analysis should be functional to determine the activities covered by the authorisation, or, consistently with paragraph 58, the scope of the authorisation, as well as, as the case may be, the availability of other suitable authorisation regimes. The review should also provide the competent authority with an understanding of the associated risk profile, including ML/TF risk, and the impact on the capital requirements, liquidity and funding needs as well as on internal governance arrangements.

(b) the geographical distribution of the activities, including their envisaged exercise through subsidiaries and branches or through the freedom to provide services within the EU or in a third country, and the planned future expansion. In particular where the business model envisages the use of digital solutions, competent authorities should assess whether the planned cross-border activities would fall under the ‘freedom to provide services’ or the ‘right of establishment’. The analysis should support, among other things, the competent authorities’ understanding of the need for any further regulatory requirement to gain access to the target markets (e.g. passport notification), any related regulatory risk, and the business or financial rationale for the envisaged corporate structure and geographical distribution. It should also be supported by the analysis of the ML/TF risk associated with a jurisdiction, conducted in the context of the assessment of the operational structure. Where an applicant credit institution intends to carry out a large part of its activities outside of the jurisdiction where it submitted the application for authorisation, the competent authority, in accordance with recital (16) CRD, should assess whether the choice of the jurisdiction of application has the purpose of avoiding stricter regulatory standards (e.g. in respect of the AML/CFT regime) in force in another Member State.

(c) the overall strategy, exploring the business rationale of the applicant credit institution, as well as the overall group strategy when the applicant belongs to a group. This includes an appropriate understanding of the strategic goals, the key business drivers, any identified competitive advantage, quantitative and qualitative objectives of the business plan, including the company’s product or service, the value proposition, and the market positioning.

76. With specific regard to innovative business models and/or delivery mechanisms, competent authorities should also pay attention to the description of the innovative features of the envisaged services and products, including any potential increased exposure to ML/TF risk. In line with the proportionality and risk-based approach, competent authorities may consider reviewing the underlying explanation of the new product’s attractiveness, product pricing, structure and comparative advantage. Such a review should be coordinated and complemented with the target market analysis as described in section 7.2.3, and the potential impact of the external key indicators on the business strategy.

77. A clear understanding of the planned business strategy will allow the competent authorities to assess the related funding strategy, the relevant external and internal factors to achieve the strategic goals and the plausibility of the quantitative assumptions. Overall, the assessment should provide the competent authority with a view on the strengths, weaknesses, opportunities and risks of the business strategy.

7.2.2 Funding structure, liquidity assessment and management

78. Competent authorities should achieve a clear view on the planned sources to finance the planned business activities, including the source(s) of the initial capital amount. Competent authorities should review the information submitted by the applicant credit institution (in particular pursuant to Article 4 of the RTS on information for authorisation) to assess the liquidity profile and the liability structure, with a special focus on the credibility of the underlying assumptions. With respect to the liability structure, the competent authorities should assess the different sources of funding (types of liabilities, instruments and counterparties), the related costs, embedded options and their contractual and behavioural maturities. A clear view on the liquidity profile and the liability structure will allow the competent authorities to assess the projections for the regulatory liquidity and funding ratios such as the LCR18 and NSFR19, also having regard to their development over the planning horizon due to the gradual increase in business activities and the implementation of the funding strategy (e.g. gradual attraction of depositors) in the set-up phase. Competent authorities should also take into account that while in the first year of activities the majority of the available sources of funding are usually stable (e.g. share capital) and the proportion of liquid assets is high, the development of the regulatory ratios may vary depending on the planned business activities and the related funding strategy of the applicant.

79. Competent authorities should perform a more intense assessment, including detailed questions relating to potential alternative scenarios, if the funding structure shows high levels of concentration or an imbalanced funding profile (e.g. excessive maturity mismatch).

80. Funding costs should be assessed in the context of the assessment of the financial forecast (see 8.2.5) as part of the profit and loss of the applicant credit institution and, where feasible and appropriate, they should be compared against peers. Furthermore, the underlying assumptions – in particular the planned interest rates – should be assessed against the business and macroeconomic environment.

[18] See Commission Delegated Regulation (EU) 2015/61 to supplement Regulation (EU) No 575/2013 of the European Parliament and the Council with regard to liquidity coverage requirement for Credit Institutions.

[19] See Title IV – Part Six CRR (introduced in CRR II).

81. The competent authorities should review the submitted information, in particular as set out in Article 4, letter (g), n. (ii) to (v)20 of the RTS on information for authorisation, in order to assess the applicant credit institution’s ability to finance, monitor, update and report its liquidity position and the relative buffers, in line with its needs21.

82. Competent authorities should review the submitted information in particular as set out in Article 4, letter a) n. (v)22 of the RTS on information for authorisation, with the aim of assessing the overall preparedness of the internal liquidity adequacy assessment process, having regard, for instance, to the following aspects:

(a) liquidity governance. Competent authorities should gain a clear understanding of the effective capacity of the institution to manage its liquidity, including whether the respective functions have sufficient resources to ensure sound liquidity management and are able to compute the NSFR and LCR. Competent authorities should also gain a clear understanding of the reporting lines set up to discuss the institution’s liquidity and related risks, including the intended content and frequency of reports to the management body, senior management and relevant committees (if applicable) in order to establish that they can discuss and challenge the relevant matters;

(b) the funding strategy and liquidity planning. Competent authorities should gain a clear understanding of the capacity of the credit institution to design scenarios, including stress testing and contingency funding plans;

(c) the liquidity internal controls framework. Competent authorities should gain a clear understanding of the envisaged processes of reviewing, validating and substantiating with evidence (e.g. reports, control evidence).

83. Consistently with the proportionality approach set out in paragraph 70, competent authorities should assess the applicant credit institution’s ability and preparedness to withstand funding stress. For this purpose, competent authorities should analyse the impact of the submitted funding and liquidity stress scenario, such as a rise of funding costs, on the liquidity and funding ratios.

84. Where relevant, competent authorities should ensure that the submitted description of the relevant process for the preparation of the recovery plan captures liquidity and funding indicators.

[20] Article 4, letter (g) of the RTS on information for authorisation provides that the application shall set out ‘an outline of the following frameworks and policies of the applicant credit institution: […] (b) liquidity risk management policy; (c) funding concentration and diversification policy; (d) collateral management policy; (e) deposit policy’.

[21] See section 9.4, Internal control framework.

[22] Article 4, letter (h) of the RTS on information for authorisation provides‘The application shall set out all of the following on the financial situation of the applicant credit institution: […] a summary of the internal liquidity adequacy assessment, at consolidated, sub-consolidated and individual levels as applicable, demonstrating that the credit institution’s liquidity resources will be adequate to meet its individual liquidity requirements; […]’.

85. In the assessment of risks to liquidity and funding, competent authorities should verify the applicant credit institution’s future compliance with minimum requirements provided by the relevant EU and national implementing legislation. However, the scope of the assessment could be extended beyond those minimum requirements, with the aim of allowing competent authorities to request higher liquidity resources from the applicant credit institution in order to compensate for unidentified risks and uncertainties.

7.2.3 Key external factors including business environment

86. To form a view on the plausibility of an institution’s strategic assumptions, competent authorities should cover the business plan’s key external factors, including the business environment, as part of their overall assessment, in accordance with the criteria indicated below.

87. Consistently with the proportionality approach set out in paragraph 70, competent authorities should review the overview of the target markets analysis submitted by the applicant credit institution with the aim of achieving an appropriate understanding of the existing business environment, considering the activities of the main existing players and prospective competitors in the target market(s), and of the likely development of the business environment.

88. For this purpose, competent authorities should review the analysis of the trends in the target market that may have an impact on the institution’s performance and profitability. These may include, on a case-by-case basis, regulatory and macroprudential trends (e.g. changes to retail banking product distribution legislation or changes in maximum loan-to-value ratios allowed for mortgages), technological trends (e.g. moves to electronic platforms for certain types of trading) and societal/demographic trends (e.g. customer composition, product switches as a result of changing market trends, greater demand for Islamic banking facilities).

89. Where appropriate and on a case-by-case analysis, reference to existing players and potential competitors could include, in addition to incumbent financial institutions, global technology companies expanding into financial services. Such an analysis should also be conducted in coordination with the review of the target market, including the impact of such competitors on the applicant credit institution, for instance on direct consumer marketing.

7.2.4 Key internal factors

90. Consistently with the proportionate approach set out in paragraph 71 and on a case-by-case basis, competent authorities should undertake an analysis of qualitative features of the applicant credit institution’s envisaged business model to understand its success drivers and key dependencies in forming the applicant credit institution’s view.

91. In this regard, the areas for analysis by competent authorities should include the main endogenous factors that influence the success of the business model, such as the applicant credit institution’s envisaged strengths in the relationships with customers, suppliers and partners, the quality of IT platforms and operational and resource capacity, as well as factors such as third-party providers, intermediaries, potential exposure to ML/TF risk and specific regulatory drivers.

92. Competent authorities should also assess whether the financial forecasts match the business strategy laid out in the plan, whether there is a clear plan towards implementation and the capacity to execute and implement the business plan. In this latter regard, the competent authorities’ review should also take into account the assessment of the management’s professional capability on an ongoing basis, including with regard to the business plan and its changes over time, and the availability of sufficient human resources to ensure the implementation of the business strategy. To support this assessment, competent authorities should take into account the previous professional experience of the members of the management body.

7.2.5 Financial forecasts

93. Competent authorities should perform a quantitative review of the applicant credit institution’s business plan focusing on the submitted financial forecasts, for both the base case and stress scenario – having regard to the geographical distribution, the types of activities and the market position at the individual and, where applicable, consolidated group or sub-consolidated level (Article 4, letter (a) of the RTS on information for authorisation 23 ). Competent authorities should also review financial positions (e.g. based on the balance sheet), risk (e.g. based on the total risk exposure amount, ‘TREA’, or other measures of risk) and/or organisational and/or statutory constraints.

94. The purpose of the quantitative review of the financial forecasts of the business plan should be to assess the credibility of the underlying assumptions (with respect to business growth, generation of revenues, estimation of costs and underlying risks), of the viability and sustainability of the applicant’s business model and of its overall ability to achieve the projected results in compliance with prudential requirements in both the base case and stress scenario.

95. The assessment of the financial forecasts should reflect the applicant credit institution’s targeted business strategy with respect to the applicant credit institution’s most material geographies, including subsidiaries, branches, activities provided via freedom to provide services, types of activities, business lines and product lines based on profit contribution (e.g. based on P&L) and examine the credibility of the underlying quantitative assumptions (e.g. business per region, income from fees, number of customers, staff costs, macroeconomic assumptions, etc.).

[23] Article 4, letter (a) of the RTS on information for authorisation provides that the application shall set out ‘forecast information on the applicant credit institution at an individual level and, where applicable, at consolidated group and sub-consolidated levels (indicating the share represented by the credit institution), at least on a base case and stress scenario basis, including: [..]’.

96. When assessing the profitability of the business plan, competent authorities should pay special attention to those areas of the targeted business strategy which are most relevant for the future sustainability of the business model and survival in stress situations. To the extent possible, and where appropriate, they should also have regard to the applicant credit institution’s exposure to existing or new risks and vulnerabilities.

97. For these purposes, competent authorities should review the explanation of the initial viability of the credit institution and of the sustainability of the business model over a period of time required by the applicant credit institution to reach the steady state, in any case over at least a three-year period. With regard to the stress scenario, it should be sufficient for the credit institution to be able to comply with the prudential requirements at the end of the planning horizon.

98. Competent authorities may need to assess a business plan with a longer time horizon, for instance of up to five years. This may be the case, for instance, in respect of those applicants whose business cycle develops over five years or whose three-year business plans show sustainability weaknesses. In such cases, the level of intensity of the assessment should be calibrated according to the business plan’s risk profile, potential weaknesses and uncertainty linked to the longer time horizon.

99. To the extent possible and where appropriate, competent authorities should determine a relevant peer comparison for the applicant credit institution. The competent authority should determine the peer or the peer group on the basis of the rival product/business lines targeting the same source of profits/customers and base the analysis on supervisory, market and macroeconomic data in the possession of the competent authority. In such cases, the assessment’s output deriving from the peer comparison should complement the competent authority’s expert judgment. If the peer comparison is not feasible, the competent authorities should rely on expert judgment.

100. Competent authorities should consider assessing profitability trends and ratios, having regard to the risks the applicant credit institution envisages assuming and the relative performance compared to peers. To support this assessment, competent authorities may refer to the most common profitability and risk indicators such as return on equity, return on assets, cost to income ratio, cost of risk and leverage ratio. The competent authority’s use of specific indicators should reflect the type and level of risk envisaged by the applicant credit institution to generate profits (for instance an institution generating lower and more stable returns with a conservative risk appetite may be more sustainable than one with high returns but a very aggressive risk appetite). Competent authorities should carefully assess the risk underlying the economic performance (e.g. the level of risk of assets), also taking into account risk-adjusted indicators to the extent possible.

101. Competent authorities should be able to gain a clear understanding of the institution’s sources of profit and loss generation (notably of the underlying drivers such as volumes – stock and flow – and prices/margins) in order to identify the key drivers and dependencies of a business performance and potential vulnerabilities. Where appropriate in light of the proportionality approach set out in paragraph 70, competent authorities should perform a breakdown of revenues/source of income in order to understand whether the expected sources of revenues are consistent with the overall targeted business strategy (type of business model, size of the business). In this regard, competent authorities should pay attention to excessively optimistic profit expectations, relating for instance to the forward interest rate and to other relevant revenue generating assumptions, and their potential impact on the reliability and, ultimately, the sustainability of the projections.

102. Consistently with the principle of proportionality set out in paragraph 70, competent authorities should review the applicant credit institution’s product pricing and structure. For this purpose, consideration may be given, for instance, to the:

(a) reliance on risky or concentrated sources of income (e.g. sub-prime mortgages, leveraged finance loans, consumer credit, specific customer groups) and its effects on the business model, such as increased vulnerability to changes in the business environment (e.g. decrease in price of real estate, decrease in demand for the products financed through the consumer loans);

(b) reliance on more volatile sources of income (e.g. trading income, hedging income or other non-recurring sources) and the implications for the long-term sustainability of revenues.

103. Competent authorities should gain a clear understanding of the various revenue models (e.g. interest-income-based (e.g. customer credit business) or fee-income-based (e.g. trade finance, correspondent banking, custody or advisory services), the specific revenue drivers, the key performance indicators and the level of risk of the related business lines. In all cases, they should gain a clear understanding of the applicant credit institution’s revenue model, how it expects to generate income in both business-as-usual and stress situations and the credibility of the underlying assumptions.

104. Competent authorities should pay particular attention to high growth rates and associated risk assumptions, including in relation to the applicant credit institution’s adequacy of execution and risk management capabilities, to support the achievement of the targeted projections, in accordance with the analysis carried out pursuant to paragraph 92. The assessment of the credibility of the underlying assumptions should be conducted having regard to various elements, including the overall business strategy, product pricing, the business environment, the funding strategy, risk tolerance and appetite, the existence of policies aimed at ensuring sound and prudent management, etc. With reference to the sustainability of the business model, competent authorities should gain a thorough understanding of the cost structure and the relevant indicators, for example the development of the cost to target income ratio (absolute or relative to peers) at the end of the envisaged business plan time horizon and in stressed situations.

105. The target cost structure (e.g. labour, administrative or IT costs) should be reviewed in absolute terms and, where possible and appropriate, compared to peers, being mindful of the significant negative impact that the underestimation of certain costs, in particular during the start-up phase or in stressed situations, may have on the sustainability of the business model and/or strategy. Competent authorities should pay attention to recurring cost concentrations that may reflect rigidity in the cost structure.

106. With specific regard to cost models, applicant credit institutions significantly relying on technology-enabled business models are likely to incur lower marginal costs than credit institutions with transactions linked to high variable costs. As a consequence, such business models’ profitability is in principle likely to increase after a certain critical mass is achieved that absorbs the fixed investment costs. Competent authorities should therefore consider key expenditures for such applicants, such as engineering or product marketing talent and investment in infrastructure.

7.2.6 Overall supervisory view

107. Based on the business plan and financial projections provided, the competent authorities should develop their overall supervisory view to assess (a) whether the applicant credit institution’s business model will be viable and sustainable and (b) whether the applicant credit institution will be able to comply with the prudential requirements over the planning horizon. Based on the competent authority’s expert judgment, the objective of the overall supervisory view is to form an integrated and comprehensive assessment of the business plan and financial forecasts and in particular of the credibility of the underlying assumptions. The supervisory view should be based on the assessment of the information received on the business strategy, business environment (potential peers, market trends and other external factors that could affect future profitability) and key internal factors, and compared to the applicant credit institution’s own views (financial forecasts, as explained in paragraphs 93 to 106), in order to assess their overall credibility.

108. Based on the reviewed information, the competent authority should challenge the applicant credit institution’s assumptions and develop its own supervisory view. If the assumptions are not credible, competent authorities may develop alternative assumptions and conduct a sensitivity analysis to determine the quantitative impact on the related areas of the business plan. The line-by-line challenge and the respective application of alternative assumptions, if needed, will allow the competent authority to quantify and assess the overall impact of the sensitivity analysis on the financial forecasts and ultimately on the most relevant prudential requirements. The competent authority may challenge the base case as well as stress case scenario.

109. The development of the supervisory view and the sensitivity analysis should be subject to proportionality as laid out in paragraph 70, considering the relative risk and complexity of the envisaged business model. Where the overall supervisory view differs from the applicant’s view, competent authorities may consider sharing specific observations with the applicant credit institution, with the aim of closing the information gap and deepening the understanding of the assumptions made by the applicant credit institution. The supervisory dialogue may be conducive to the submission of a revised business plan and financial forecast by the applicant credit institution, reflecting any necessary remediating measures to ensure its viability and sustainability and, ultimately, compliance with prudential requirements for the planning horizon. In such a situation, competent authorities may also consider mitigation measures, in the form of conditions precedent, obligations subsequent or restrictions as laid down in section 4.2, paragraphs 25–32.

8. Capital

8.1 General criteria

110. The determination of the level of capital should aim at ensuring the authorised credit institution’s compliance with own funds and other prudential requirements at the time of authorisation and through a severe but plausible stress scenario over at least three years.

111. For the purposes of granting the authorisation, the level of capital should be determined based on the initial capital and on the own funds requirements in accordance with the methodology laid down in section 8.2.

112. For the purposes of the CAM, the initial capital is a fixed amount set out in national law in accordance with Article 12(1)24 CRD or with Article 12(4)25 CRD, as the case may be.

113. The own funds requirements are risk-based26 and leverage-based27 capital requirements in accordance with Title I, Part Two and Three CRR.

114. Irrespective of the differences across the EU relating to the absolute value of initial capital set out in national law, the CAM aims to ensure that the level of capital is set to ensure compliance with prudential requirements at authorisation in the baseline scenario, and in the course of at least three years of the planning time horizon in a severe but plausible stress scenario.

115. The determination of the level of capital at authorisation and the amount to be paid up at authorisation as set out in section 8.2 and section 8.3 below are without prejudice to more stringent requirements laid down at the national level.

8.2 Determination of the level of the capital

116. For the purpose of determining the level of the capital, competent authorities should:

(a) appropriately identify the risks (and related RWAs) based on the business plan reviewed in accordance with section 7.2.6, and estimate the own funds requirements (risk-based and leverage-based) for at least three years (i.e. the own funds necessary to cover full

[24] ‘Without prejudice to other general conditions laid down in national law, the competent authorities shall refuse authorisation to commence the activity of a credit institution where a credit institution does not hold separate own funds or where its initial capital is less than EUR 5 million’.

[25] ‘Member States may grant authorisation to particular categories of credit institutions the initial capital of which is less than that specified in paragraph 1, subject to the following conditions: (a) the initial capital is no less than EUR 1 million; (b) the Member States concerned notify the Commission and EBA of their reasons for exercising that option’.

[26] CET1, T1, Total Capital requirements.

[27] Leverage ratio.

compliance with the prudential requirements throughout and at the end of the first three years, taking into account the expected cumulated losses for that time horizon); (b) add to the initial capital the expected cumulated losses for the first three years;

(c) select the higher of (a) or (b)28.

Competent authorities should be satisfied that the estimate of the own funds requirements under letter a) of this paragraph29 is the higher30 amount deriving from the base case scenario or the severe but plausible stress scenario31 of the business plan revised in accordance with section 7.2.6. Competent authorities should ensure that the higher amount thus identified forms the basis for the calculation of the capital that the applicant credit institution is expected to have available at the moment of the authorisation as further specified in section 8.3. The portion of the capital at authorisation to be paid up before commencement of the activities is determined in accordance with paragraph 123.

117. Where the competent authority is the consolidated supervisor, it should assess the expected impact – based on the business plan reviewed in accordance with section 7.2.6 – of the newly authorised credit institution on the capital requirements at consolidated level. For this purpose the competent authority should rely on the analysis of the consolidation perimeter assessed in accordance with paragraph 33.

118. If an applicant belonging to a banking group applies for capital waivers in accordance with Articles 7 or 10 CRR, competent authorities may consider, within their discretionary powers under the aforementioned provisions, assessing the applicant’s eligibility for the application of the waiver in a strict and scrupulous manner, taking into account the particularities of the authorisation application.

119. Where the competent authority, in the exercise of its discretion, considers itself to be in a position to conduct a strict and scrupulous assessment and establishes that the relevant conditions set out in the CRR are satisfied and the waiver may be granted, and such a waiver is granted at the time of the authorisation, the capital at authorisation (and the related

[28] Figures 1, 2 and 3 reported in the Annex illustrate the following cases: a) Figure 1 provides an example of the case where own funds requirements are higher than the initial capital and cumulative yearly losses; b) Figure 2 provides an example of the case where the initial capital plus the cumulative yearly losses are higher than the estimated own funds requirements; c) Figure 3 provides an example of a change in the higher amount of initial capital and losses and own funds requirements in the course of the three years that are considered to determine the capital at authorisation.

[29] And the related expected cumulative losses used to determine the amount under letter 116(b) of this paragraph.

[30] In some cases it is the baseline scenario of the business plan rather than the adverse scenario (both properly challenged by the competent authority, if needed) that may lead to the determination of higher own funds requirements (due, for instance, to stronger business growth) and as a consequence to higher capital requirements as a whole (including the computation of the expected losses in the course of the three years of the planning time horizon). In that case, the highest estimated own funds requirements within the first three-year horizon and the accumulated losses for the first three years according to the baseline scenario would determine the required quantity of capital.

[31] Consideration of the losses projected in the stress scenario should aim at ensuring an adequate level of resilience of the credit institution in the initial period of activity, also due to the fact that the P2R has not been determined yet.

payment) should be determined consistently with paragraphs 116–117 taking the waiver into account.

120. Where the competent authority considers that the capital waiver cannot be granted at the time of the authorisation, the level of capital should be determined by the competent authority in accordance with the methodology laid down in paragraphs 116–117. In specific cases where the competent authority assesses that the waiver cannot be granted at the time of authorisation, but there are reasonable grounds to assess that it could be granted at a later stage, the competent authority may implement measures to mitigate the impact of the level of capital at authorisation.

8.3 Quality, payment and availability of capital

121. The competent authority should verify the adequacy of the capital determined in accordance with section 8.2 in line with the quality requested under the relevant provisions set out in Title I, Part Two and Three CRR. In particular, in accordance with Article 12(2) CRD, initial capital is made of ‘only one or more of the items referred to in Article 26(1)(a) to (e) of [CRR]’.

122. Competent authorities should verify that the credit institution’s capital is separated from the owner assets and is fully, immediately and unrestrictedly available for the sole use of the credit institution.

123. The portion of the capital level to be paid up in full prior to granting the authorisation is the higher of the following:

a) the portion of the capital determined in accordance with section 8.2 which is required to cover in full the first year of activity (i.e. the own funds necessary to cover full compliance with the prudential requirements throughout and at the end of the first twelve months, taking into account the expected losses for that time horizon); or

b) the initial capital plus the first-year losses.

124. Competent authorities should verify and review through adequate evidence that the portion of capital paid up in full according to letters a) or b) above is effectively paid up in full, is of legitimate origin and is booked in the records of the undertaking prior to granting of the authorisation. To assess the legitimate source of the funds32, competent authorities should apply the criteria set out in paragraphs 14.5 and 14.6 of the ESAs’ Joint Guidelines on the

[32] ‘Source of the funds’ means the origin of the funds involved in a business relationship or occasional transaction. It includes both the activity that generated the funds used in the business relationship, for example the customer’s salary, and the means through which the customer’s funds were transferred. The funds could also derive from a ‘source of wealth’, meaning the origin of the customer’s total wealth, for example inheritance or savings, see paragraph 12, letters (n) and (o) of the EBA ML/TF Risk Factor Guidelines, EBA/GL/2021/02 of 1 March 2021, available at https://www.eba.europa.eu/regulation-and-policy/anti-money-laundering-and-e-money/revised-guidelines-on-ml-tf-risk-factors

prudential assessment of the proposed acquisition of qualifying holdings 33, relating to the activity that generated the funds and the means through which they have been transferred, having regard to whether they may give rise to an increased risk of money laundering or terrorist financing.

125. Without prejudice to the above, in those jurisdictions where the portion of the capital indicated in letters a) or b) of paragraph 123 has to be paid up before commencing the activities as a credit institution, rather than before granting the authorisation, competent authorities, for the purpose of granting the authorisation, should carefully review the plan and the implementation deadline submitted by the applicant in accordance with Article 6(2) of the RTS on information for authorisation34 in order to ensure that such a capital amount is paid up in full before commencing the activities as a credit institution and is of legitimate origin.

The competent authority should include an express condition in the authorisation, suspending the effects of the authorisation at least until the actual payment of the portions of the capital identified therein.

126. Competent authorities should be satisfied that the applicant credit institution has a capital implementation plan in place addressing the outstanding amount of capital determined in accordance with section 8.2, which has not been paid up at the time of the authorisation according with paragraphs 123 and 124 and which is destined to cover the activities of the second and the third year. Such a capital implementation plan should indicate the type of funding sources and the timing of capital injections in order to avoid a potential failure to meet business objectives and a potential incurrence of losses affecting compliance with minimum capital requirements by the credit institution. The type of funding sources – such as shareholders’ private financial resources, financial instruments issued or to be issued in the financial markets and any agreements and contracts entered into in respect of own funds – should be carefully reviewed with the aim of ensuring that they are of legitimate origin and, based on their terms and conditions, will be promptly available.

[33] JC/GL/2016/01 of 20 December 2016 on the prudential assessment of acquisitions and increases of qualifying holdings in the financial sector, available at: https://eba.europa.eu/regulation-and-policy/other-topics/joint-guidelines-for-the-prudential-assessment-of-acquisitions-of-qualifying-holdings 34 ‘Where the initial capital has not been paid-up in full at the time of submitting the application to the competent

[34] authority, the application shall set out the envisaged plan and implementation deadline for ensuring that the initial capital is paid-up in full before authorisation to commence the activity of credit institutions’.

9. Internal governance

9.1 General criteria

127. Competent authorities should perform a careful and comprehensive review of the arrangements, processes and mechanisms relating to the applicant credit institution’s internal governance, being mindful that pursuant to Article 10(2) CRD, in the case of failure to demonstrate sound and effective risk management by that institution, competent authorities have to refuse granting the authorisation.

128. The CAM laid down herein aims to guide the competent authorities’ assessment of the application documents relating to internal governance arrangements, operational structure, policies and processes. The CAM provides guidance on the main elements and aspects to be assessed by the competent authorities for the purpose of granting the authorisation and is without prejudice to the application of additional parts of the EBA Guidelines on internal governance (second revision) 35 , the EBA and ESMA Guidelines on the assessment of the suitability of members of the management body and key function holders (revised)36, the EBA Guidelines on remuneration (revised)37, the EBA Guidelines on outsourcing arrangements38 and the EBA Guidelines on ICT and security risk management 39 . The competent authorities’ assessment should aim at ensuring the compliance of the credit institution with the EBA Guidelines referred to.

129. For the purposes of this section, and consistently with paragraph 13, the governance framework, in particular the internal control framework, including the risk management framework, covers also the risk of ML/TF and should be assessed in line with the EBA ML/TF Risk Factors Guidelines 40 when assessing the adequacy of applicant credit institutions’ AML/CFT policies and procedures.

130. Competent authorities should achieve a comprehensive understanding of how the credit institution is organised and a clear view on its governance and operational structure, as well as other arrangements, processes and mechanisms, which should be well designed. The

[35] EBA/GL/2021/05 of 2 July 2021, available at https://www.eba.europa.eu/guidelines-internal-governance-second-revision

[36] EBA/GL/2021/06 of 2 July 2021, available at https://www.eba.europa.eu/joint-esma-and-eba-guidelines-assessment-suitability-members-management-body-revised

[37] EBA/GL/2021/04 of 2 July 2021, available at https://www.eba.europa.eu/regulation-and-policy/remuneration/guidelines-on-sound-remuneration-policies-second-revision

[38] EBA GL/2019/02 of 25 February 2019, available at https://eba.europa.eu/regulation-and-policy/internal-governance/guidelines-on-outsourcing-arrangements

[39] EBA/GL/2019/04 of 29 November 2019, available at https://eba.europa.eu/regulation-and-policy/internal-governance/guidelines-on-ict-and-security-risk-management

[40] EBA/GL/2021/02 of 1 March 2021, available at https://www.eba.europa.eu/regulation-and-policy/anti-money-laundering-and-e-money/revised-guidelines-on-ml-tf-risk-factors

applicant should be adequately equipped to be considered sufficiently able to perform the targeted activities in a sound and prudent manner.

131. Competent authorities should be satisfied that the application documents envisage arrangements, processes and mechanisms that adequately demonstrate the presence of a clear, transparent and robust governance structure ensuring effective decision-making and good governance, and that the powers and responsibilities are clearly allocated at all levels of the organisation and among the governing bodies.

132. The intensity of the competent authorities’ assessment of internal governance requirements should take into account proportionality criteria set out in paragraphs 17–21 of these Guidelines and the applicant’s individual risk profile.

133. The assessment should be based on the documents and information submitted by the applicant credit institution pursuant, in particular, to Article 1, letter l), Article 4, letters (g) and (h) and Article 5(1), letters (b) to (f) of the RTS on information for authorisation and any additional document the competent authority requests in accordance with Article 10(1) of those RTS.

9.2 Management body

9.2.1 Management body in management function and management body in supervisory function

134. The Guidelines intend to embrace all existing board structures and do not advocate any particular structure. They do not interfere with the general allocation of competences in accordance with national company law. Accordingly, they should be applied irrespective of the board structure used (unitary and/or dual board structure and/or another structure) across Member States. The management body, as defined in points (7) and (8) of Article 3(1) of Directive 2013/36/EU, should be understood as having management (executive) and supervisory (non-executive) functions41.

135. Competent authorities should review the application, in particular the articles of association or other equivalent constitutional documents 42 and the terms of reference of the management body43, and be satisfied that the documents adequately cover the management body’s roles and responsibilities, distinguishing between the duties of the management (executive) function and of the supervisory (non-executive) function. In line with this, competent authorities should in particular:

(a) verify that the management body has ultimate and overall responsibility of the institution and defines, oversees and is accountable for the implementation of the

[41] Paragraph 8 of the EBA Guidelines on internal governance. See also recital 56 of Directive 2013/36/EU.

[42] Submitted pursuant to the RTS on information for authorisation.

[43] Submitted pursuant to the RTS on information for authorisation.

governance arrangements within the institution that ensure effective and prudent management of the institution44;

(b) be satisfied that the responsibilities entrusted to the management body45 include setting, approving and overseeing the implementation of: a) the overall business strategy and the key policies of the credit institution; b) the overall risk strategy, including the credit institution’s risk appetite, its risk management framework and measures to ensure that the management body devotes sufficient time to risk issues and to performing its function; c) an adequate and effective internal governance and internal control framework that includes a clear organisational structure and well-functioning independent internal risk management, compliance and audit functions that have sufficient authority, stature and resources to perform their functions; d) an adequate and effective internal governance and internal control framework, to ensure compliance with applicable requirements, including in the context of the prevention of money laundering and terrorism financing; e) the amounts, types and distribution of both internal capital and regulatory capital to adequately cover the risks of the institution; f) targets for the liquidity management of the institution; g) a remuneration policy as described in paragraphs 170 and 171; h) arrangements on the individual and collective suitability, composition, effectiveness and succession planning of the management body; i) a selection and suitability assessment process for key function holders 46 ; j) arrangements aimed at ensuring the internal functioning of each committee of the management body, when established47; k) a risk culture which addresses the institution’s risk awareness and risk-taking behaviour; l) a corporate culture and values which foster responsible and ethical behaviour, including a code of conduct or similar instrument; m) a conflict of interest policy at institutional and staff level; and n) arrangements aimed at ensuring the integrity of the accounting and financial reporting systems, including financial and operational controls and compliance with the law and relevant standards;

(c) be satisfied that the application envisages that when setting, approving and overseeing the implementation of the tasks referred to in letter (b) above, the management body should aim at ensuring a sustainable business model that takes into account all risks, including environmental, social and governance risks;

[44] Paragraph 19 of the EBA Guidelines on internal governance.

[45] See paragraph 22 of the EBA Guidelines on internal governance.

[46] As defined in the EBA Guidelines on internal governance, the expression ‘key function holder’ ‘means persons who have significant influence over the direction of the institution but who are not members of the management body and are not the CEO. They include the heads of internal control functions and the CFO, where they are not members of the management body, and, where identified on a risk-based approach by institutions, other key function holders. Other key function holders might include heads of significant business lines, European Economic Area/European Free Trade Association branches, third country subsidiaries and other internal functions’. See also Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders.

[47] In accordance with paragraph 22(i) of the EBA Guidelines on internal governance, such arrangements should detail ‘i. role, composition and tasks of each of them; ii. appropriate information flow, including the documentation of recommendations and conclusions, and reporting lines between each committee and the management body, competent authorities and other parties’.

(d) be satisfied that the relevant application documents envisage arrangements aimed at ensuring that the individual and collective suitability assessments of the management body are carried out effectively, that the roles and responsibilities of the chair are clearly defined, that the composition and succession planning of the management body are appropriate, and that the management body will perform its functions effectively, in compliance with the EBA Guidelines on internal governance and EBA Guidelines on suitability assessment;

(e) assess that the management body in its management function will be entrusted with the responsibility for the implementation of the strategies set by the management body and discuss regularly the implementation and appropriateness of those strategies with the management body in its supervisory function. The management body in its management function should also be empowered to constructively challenge and critically review propositions, explanations and information received when exercising its judgment and taking decisions on the strategy of the institution48;

(f) be satisfied, without prejudice to the responsibilities assigned under the applicable national company law, that the tasks of the management body in its supervisory function should include 49: a) overseeing and monitoring management decision-making and actions and providing effective oversight of the management body in its management function, including monitoring and scrutinising its individual and collective performance and the implementation of the institution’s strategy and objectives; b) ensuring and periodically assessing the effectiveness of the credit institution’s internal governance framework and taking appropriate steps to address any identified deficiencies; c) overseeing and monitoring whether the credit institution’s strategic objectives, organisational structure and risk strategy, including its risk appetite and risk management framework, as well as other policies (e.g. remuneration policy) and the disclosure framework are implemented consistently; d) monitoring whether the risk culture of the credit institution is implemented consistently; e) overseeing the implementation and maintenance of a code of conduct or similar and effective policies to identify, manage and mitigate actual and potential conflicts of interest; f) overseeing the integrity of financial information and reporting, and the internal control framework, including an effective and sound risk management framework; g) ensuring that the heads of internal control functions are able to and do act independently and, regardless of the responsibility to report to other internal bodies, business lines or units, can raise concerns and warn the management body in its supervisory function directly, where necessary, when adverse risk developments affect or may affect the institution; and h) monitoring the implementation of the internal audit plan, after the prior involvement of the risk and audit committees, where such committees are established;

(g) verify that the relevant application documents relating to the committees that will be established include their combination, composition, role and allocation of duties and tasks

[48] See paragraph 30 of the EBA Guidelines on internal governance.

[49] See paragraph 34 of the EBA Guidelines on internal governance.

between specialised committees of the management body, in accordance with the relevant provisions of the EBA Guidelines on internal governance.

136. In accordance with Article 46(4) of Directive 2015/849 (AMLD), competent authorities should also verify that the application documents envisage the identification of the member of the management body to be responsible for the implementation of the laws, regulations and administrative provisions necessary to comply with AML/CTF requirements.

9.2.2 Suitability assessment of the management body and of the key function holders

137. In accordance with Article 13(1), second sub-paragraph, CRD competent authorities should subject the members of the management body of the credit institution to a suitability assessment and shall refuse to grant the authorisation where they do not meet the requirements set out in Article 91(1) CRD.

138. Where applicable, competent authorities should also subject to a suitability assessment the key function holders, as defined in the EBA Guidelines on internal governance.

139. Such a suitability assessment should be performed in compliance with the EBA and ESMA Guidelines on the suitability assessment of the management body and key function holders.

9.3 Organisational structure

140. Competent authorities should verify that the credit institution’s organisational structure demonstrates a solid organisation with the availability of effective reporting lines, allocation of responsibilities and risk measurement and management including subsequent monitoring, in order to ensure the credit institution’s sound and prudent management. The review should also include the organisational chart laying down the envisaged internal organisation in terms of departments, divisions, teams and related allocation of staff.

141. Competent authorities should carefully assess whether the submitted organisational structure – including the projected size, FTE number and systems – is commensurate with the business model, the types and geographical distribution of the activities and the risks that the applicant credit institution intends to undertake. Such an assessment should therefore be supported by the business plan reviewed in accordance with section 7 of these Guidelines.

142. For the purposes of granting the authorisation or of commencing the activities as the case may be, competent authorities should be sufficiently satisfied of the progress being made as regards the implementation of the organisational structure, including the progress in hiring the indicated personnel with the adequate qualifications.

143. Competent authorities should pay specific attention to avoiding the setting up of non-transparent or unnecessarily complex structures that have no clear economic rationale or legal purpose or that could be used for an objective connected to money laundering or other financial crimes50.

144. When the business plan envisages the setting up of structures in other jurisdictions, competent authorities should assess the effective compliance of such jurisdictions with ‘EU and international standards on tax transparency, AML and CFT’ 51. They should also assess the extent to which the envisaged structure serves an obvious and lawful economic purpose, or the extent to which it could be used to hide the identity of the ultimate beneficial owner, or whether the business strategy (including the customer’s request underlying the setting up of the structure) gives rise to concern. Competent authorities should assess whether the structure impedes appropriate oversight by the institution’s management body or the institution’s ability to manage the related risk, and whether the structure poses obstacles to effective supervision by competent authorities52.

9.3.1 Corporate values, risk culture, code of conduct and governance policies

145. Competent authorities should verify that the terms of reference of the management body relating to corporate values ensure the adoption, promotion and implementation of high ethical and professional standards, creating an environment of effective challenge in which decision-making processes promote a range of views.

146. Consistently with Article 5(1), letter c) n. (ii), fifth indent of the RTS on information for authorisation, competent authorities should also review the outline of the policy promoting diversity of the management body and be satisfied that it is in line with the criteria set out in Article 88(2)(a) CRD and it sets a quantitative or, as appropriate, qualitative target for promoting diversity, and the frequency of assessment.

9.3.2 Conflicts of interest policy

147. Competent authorities should verify that the outline of the conflicts of interest policy makes the management body responsible for ‘establishing, approving and overseeing the implementation and maintenance of effective policies to identify, assess, manage and mitigate or prevent actual and potential conflicts of interest at institutional level’ as well as between the institution and the staff, including the management body and staff’s closest family members53.

[50] Paragraph 76 of the EBA Guidelines on internal governance reads: ‘Institutions should avoid setting up complex and potentially non-transparent structures. Institutions should take into account in their decision-making the results of a risk assessment performed to identify whether such structures could be used for a purpose connected with money laundering or other financial crimes and the respective controls and legal framework in place [..]’.

[51] Paragraph 76, letter (a) of the EBA Guidelines on internal governance reads: ‘the extent to which the jurisdiction in which the structure will be set up complies effectively with EU and international standards on tax transparency, anti-money laundering and countering the financing of terrorism;’.

[52] Paragraph 76 letters a) to f) of the EBA Guidelines on internal governance.

[53] See sections 11 and 12 of the EBA Guidelines on internal governance.

148. With regard to conflicts of interest at the institution’s level, competent authorities should be satisfied that the outline of the conflicts of interest policy requires that ‘[i]nstitutions’ measures to manage or where appropriate mitigate conflicts of interest should be documented’ 54 and includes appropriate segregation of duties, information barriers and procedures for transactions with related parties.

149. As to conflicts of interest at the staff level, competent authorities should be satisfied that the policy covers at least the situations envisaged in paragraph 109 of the EBA Guidelines on internal governance 55 , and that it envisages ‘procedures, measures, documentation requirements and responsibilities for the identification and prevention of conflicts of interest, for the assessment of their materiality and for taking mitigating measures’.

9.3.3 Whistleblowing, market abuse, product governance, consumer protection, complaints handling

150. Competent authorities’ review of the outlines of the whistleblowing policy should ensure that staff may safely report potential or actual breaches of regulatory or internal requirements. To avoid conflicts of interest, it should be possible for staff to report breaches outside regular reporting lines. The alert procedures should ensure the protection of the personal data of both the person who reports the breach and the natural person who is allegedly responsible for the breach in accordance with Regulation (EU) 2016/679, General Data Protection Regulation.

151. Competent authorities should be satisfied that the outline of the policy covers the process for handling information on a potential or an actual breach and the protection of the person reporting it in line with the EBA Guidelines on internal governance.

152. Competent authorities’ review of the outline of the market abuse policy should ensure the credit institution’s adherence to appropriate standards preventing market abuse. In particular it should include the process for identifying, managing and reporting the market abuse infringements.

[54] See paragraph 107 of the EBA Guidelines on internal governance.

[55] Paragraph 111 of the EBA Guidelines on internal governance reads: ‘The policy should cover at least the following situations or relationships where conflicts of interest may arise: a. economic interests (e.g. shares, other ownership rights and memberships, financial holdings and other economic interests in commercial customers, intellectual property rights, loans granted by the institution to a company owned by staff, membership in a body or ownership of a body or entity with conflicting interests); b. personal or professional relationships with the owners of qualifying holdings in the institution; c. personal or professional relationships with staff of the institution or entities included within the scope of prudential consolidation (e.g. family relationships); d. other employment and previous employment within the recent past (e.g. five years); e. personal or professional relationships with relevant external stakeholders (e.g. being associated with material suppliers, consultancies or other service providers); and f. political influence or political relationships’.

153. Competent authorities should verify that, in line with the EBA Guidelines on product oversight and governance arrangements for retail banking products 56 , the outline of the product governance policy ensures that the applicant credit institution, acting as manufacturer and/or distributor, will implement a sound product governance policy providing for internal processes, functions and strategies (i) to ensure that the interests, objectives and characteristics of consumers are taken into account, (ii) to avoid potential consumer detriment and (iii) to minimise conflicts of interest.

154. Competent authorities’ review of the outline of the consumer protection policy should aim at ensuring that the applicant credit institution will establish a sound consumer protection policy to provide adequate information to and protection of consumers. In particular, the outlines should ensure that the consumer protection policy complies with the regulatory framework and provides adequate training to the relevant staff. To this end it should cover standards and principle, compliance monitoring and staff awareness.

155. Competent authorities’ review of the outlines of the complaints handling policy should aim at ensuring that the credit institution will provide consumers with adequate protection in compliance with the applicable regulatory requirements. The outline should cover the process for receiving, assessing and replying to complaints.

9.4 Internal control framework

156. Competent authorities should assess whether the applicant credit institution has an appropriate internal control framework which is commensurate with the credit institution’s envisaged activities, business model, complexity and associated risks (e.g. online onboarding of clients, cybersecurity protection and arrangements). Competent authorities should be satisfied of the adequacy of the allocated human resources both in terms of number of FTEs and qualifications, of the appropriateness of the systems and budget to support the conduct of the tasks.

157. Competent authorities should review the application documents and be satisfied that the allocation of tasks and responsibilities will allow the management body to fully know the structure of their credit institution 57 and ‘ensure that the internal control functions are independent of the business lines they control, including that there is an adequate segregation of duties, and that they have the appropriate financial and human resources as well as powers to effectively perform their role. The reporting lines and the allocation of responsibilities, in particular among key function holders, within the credit institution should be clear, welldefined, coherent, enforceable and duly documented’ 58.

[56] EBA/GL/2015/18 available at https://www.eba.europa.eu/guidelines-on-product-oversight-and-governance-arrangements-for-retail-banking-products

[57] Paragraph 71of the EBA Guidelines on internal governance.

[58] Paragraph 68 of the EBA Guidelines on internal governance.

158. Competent authorities should achieve a clear view that the internal control framework covers all areas of the institution and reflects the three lines of defence model for the identification of the functions for addressing and managing risks.

159. For this purpose, competent authorities should verify that arrangements are in place to ensure that business and support units, the first line of defence, will be responsible in the first instance for identifying and managing the risks they incur in conducting their activities and for establishing and maintaining adequate processes and controls to ensure that such risks are analysed, measured, monitored, duly reported and kept within the limits of the credit institution’s risk appetite and that they are in compliance with internal and external regulatory requirements.

160. The risk management function and the compliance function, the second line of defence, together with the internal audit function, which is the third line of defence, form the internal control functions within the internal control framework. Competent authorities should verify that they will be established, taking into account the proportionality criteria set out in paragraphs 17–21, and that they will be endowed with appropriate and sufficient authority, stature and direct access to the management body to fulfil their mission.

161. To ensure that the internal control functions comply with independence requirements 59 , competent authorities should verify that, based on the application documents, it is envisaged that:

(a) their staff do not perform any operational tasks falling within the scope of the activities the internal control functions are intended to monitor and control;

(b) they are organisationally separate from the activities they are assigned to monitor and control;

(c) notwithstanding the overall responsibility of members of the management body for the institution, the head of an internal control function should not be subordinate to a person who has responsibility for managing the activities the internal control function monitors and controls;

(d) the remuneration of the internal control functions’ staff should not be linked to the performance of the activities the internal control function monitors and controls, and not otherwise likely to compromise their objectivity.

162. Competent authorities should verify that the heads of the internal control functions fulfil the following requirements:

[59] See paragraph 175 of the EBA Guidelines on internal governance.

9.4.1.1.1.1 will be established at an adequate hierarchical level that provides the head of the control function with the appropriate authority and stature needed to fulfil his or her responsibilities;

9.4.1.1.1.2 will be independent of the business lines or units they control;

9.4.1.1.1.3 will report and be directly accountable to the management body, and their performance should be reviewed by the management body;

9.4.1.1.1.4 where necessary, will have access and report directly to the management body in its supervisory function in order to raise concerns and warn the supervisory function, where appropriate, when specific developments affect or may affect the institution.

163. To ensure that internal control functions can be effectively exercised, competent authorities should be satisfied that they are allocated sufficient budgetary and human resources with adequate qualifications, having regard to the types of the targeted activities, and an appropriate ICT system and support at their disposal.

9.4.2 Risk management function

164. Competent authorities should be satisfied that, as part of the internal control framework, the credit institution will have a holistic credit-institution-wide risk management framework, recognising fully the economic substance of all the credit institution’s risk exposures.

165. Competent authorities should be satisfied that the risk management function (RMF) will facilitate the implementation of a sound risk management framework throughout the institution and that its role within the credit institution covers its involvement in: a) risk strategy and decision; b) evaluation of material changes; c) identifying, measuring, assessing, managing, mitigating, monitoring and reporting on risks; d) assessment of breaches of risk appetite or limits and recommendation of remedies. For this purpose, competent authorities should also review and assess the outline of the strategy for managing such risks and including a risk tolerance and appetite statement and measures to align the assessed risk with the risk appetite.

166. In respect of the RMF role in the risk strategy and decision-making, competent authorities’ review should aim at verifying that the application envisages the RMF’s active involvement at an early stage in the going concern in the elaboration of the credit institution’s risk strategy, in ensuring that the credit institution will have effective risk management processes in place and in providing the management body with all relevant risk-related information to enable the setting of the credit institution’s risk appetite level. Competent authorities should ensure that the RMF is envisaged to assess the robustness and sustainability of the risk strategy and appetite and that the latter is appropriately translated into specific risk limits, including at the business units level, and is involved before a decision is made by the management body concerning the risk strategies.

167. In respect of the RMF’s role in the evaluation of material changes, competent authorities should verify that the RMF’s involvement is envisaged before decisions on exceptional transactions are taken, so as to evaluate the impact of such changes and exceptional transactions on the credit institution’s overall risk, and to report its findings directly to the management body before a decision is taken.

168. As regards the RMF’s role in identifying, measuring, monitoring, mitigating and reporting risk and associated risk concentrations to be approved by the management body, competent authorities should make sure that policies and procedures are in place and that the RMF will have access to all business lines and other units which have the potential to generate risks.

169. The RMF’s role should also include the independent assessment of breaches of risk appetite or limits (including ascertaining the cause and undertaking a legal and economic analysis of the actual cost of closing, reducing or hedging the exposure against the potential cost of keeping it). It should be envisaged that the RMF will inform the business units concerned and the management body, and recommend possible remedies. For this purpose, it should be able to report directly to the management body in its supervisory function when the breach is material, without prejudice for the RMF to report to other internal functions and committees.

9.4.3 Remuneration policy

170. In respect of the outline of the remuneration policy, in addition to assessing compliance with the gender neutrality requirements under Article 92(2)(aa) CRD, competent authorities should have specific regard for verifying that the outline of the policy relating to staff members whose professional activities have a material impact on the credit institution’s risk profile60 is in line with Article 94 CRD and the EBA Guidelines on remuneration policy.

171. In particular, they should assess whether: a) the outline of the remuneration policy is in line with the institution’s envisaged risk appetite, its business strategy and its long-term interests, and it is envisaged to be maintained, approved and overseen by the management body; b) it envisages that staff who have a material impact on the institution’s risk profile will be appropriately identified in line with Article 92(3) and Article 94(3) CRD; c) it foresees specific remuneration requirements for those particular staff, inter alia (i) a ratio between variable and fixed remuneration in line with point (g) of Article 94(1) CRD and (ii) the pay-out in instruments, the deferral arrangements including malus and clawback in line with points (l), (m) and (n) of Article 94(1) CRD61.

9.4.4 Compliance function

172. Competent authorities should verify that it is envisaged that the compliance function will manage compliance risk, provide advice to the management body on measures to be taken to ensure compliance with applicable laws, rules, regulations and standards, and implement,

[60] Submitted pursuant to the RTS on information for authorisation.

[61] With specific regard to the derogations foreseen in Article 94 (3) and (4) CRD.

under the oversight of the management body, policies and processes to manage compliance risks and to ensure compliance. Competent authorities should verify that the compliance function is adequate to the types and geographical distribution of activities (e.g. compliance with the applicable national laws of various jurisdictions in the case of activities carried out on cross-border basis), risks and complexity in line with the business model and the business plan assessment conducted in accordance with section 7 of these Guidelines.

173. The compliance function should ensure that compliance monitoring is carried out through a structured and well-defined compliance monitoring programme and that the compliance policy is observed. It should also be envisaged that the compliance function and the RMF will cooperate and exchange information as appropriate to perform their respective tasks.

174. Competent authorities should also check that the compliance function will be entrusted with verifying, in close cooperation with the RMF and the legal unit, that new products and new procedures comply with the current legal framework and, where appropriate, with any known forthcoming changes to legislation, regulations and supervisory requirements.

175. Competent authorities should verify that an AML/CTF compliance function for compliance with the specific ML/TF regulation and internal policies is envisaged to be set up, either within or separate from the compliance function.

9.4.5 AML/CFT policy

176. Competent authorities should verify that the AML/CTF policy, submitted by the applicant credit institution pursuant to Article 5(1), letter c), no. (iii) of the RTS on information for authorisation, provides an overview of the key policies and procedures, as set out in Article 8(3) AMLD, that will be put in place to counter the ML/TF risk. For this purpose, competent authorities will take into account proportionality criteria set out in paragraphs 17–21.

177. Competent authorities should verify that the outline covers all elements set out in Article 8(4)62 AMLD and substantiate how the applicant credit institution will ensure it can mitigate and manage effectively the ML/TF risks to which it is exposed as of the day of access to the market.

9.4.6 Internal audit function

178. Competent authorities, taking into account the proportionality criteria set out in paragraphs 17–21, should assess the independent and effective internal audit function (‘IAF’) set up by the applicant credit institution. Competent authorities should gain a clear view that the IAF,

[62] It reads: ‘The policies, controls and procedures referred to in paragraph 3 shall include: (a) the development of internal policies, controls and procedures, including model risk management practices, customer due diligence, reporting, record-keeping, internal control, compliance management including, where appropriate with regard to the size and nature of the business, the appointment of a compliance officer at management level, and employee screening; (b) where appropriate with regard to the size and nature of the business, an independent audit function to test the internal policies, controls and procedures referred to in point (a)’.

following a risk-based approach, will be able to independently review and provide objective assurance of the compliance of all activities and units of the credit institution, including outsourced activities, with the institution’s policies and procedures and with other external (non-prudential) requirements.

179. For this purpose, competent authorities should assess whether the IAF has its organisational independence and the internal auditors' objectivity protected by direct reporting to the management body and adequate resources to perform its tasks. For this purpose, it should also be ensured that the IAF has unfettered institution-wide access to all the records, documents, information and buildings of the institution for the performance of its function.

180. Competent authorities should also assess whether the IAF is entrusted with at least the following:

(a) the appropriateness of the internal control framework, including the adequacy of policy and procedures and the compliance with legal and regulatory requirements;

(b) the development of an audit plan at least once a year on the basis of the annual internal audit control objectives and to be approved by the management body;

(c) submitting recommendations based on the findings of their its activities.

181. They should also verify that the outline of the methodology and internal audit plan covering the first three years of activity, including the audit of externalised services, are consistent with the organisational structure, types of activities and risk profile resulting from the business plan assessed in accordance with section 7.

9.4.7 Operational resilience and business continuity policy and plan

182. The outlines of the business continuity policy and plan should ensure that the applicant will have a sound business continuity management plan to ensure its ability to operate on an ongoing basis and to limit losses in the event of severe business disruption. It should ensure that the business continuity policy and plan include an analysis of the main business disruption risks and an overview of the mitigation measures and ensure regular testing of the business continuity plan.

9.4.8 ICT policy and systems

183. Competent authorities should assess whether the ICT policy will provide the credit institution with reliable information and communication systems and whether the ICT systems will be able to fully support risk data aggregation capabilities at normal times as well as during times of stress. In particular, competent authorities should assess whether the credit institution will at least be able to:

(a) generate accurate and reliable risk data;

(b) capture and aggregate all material risk data across the institution;

(c) generate aggregate and up-to-date risk data in a timely manner;

(d) generate aggregate risk data to meet a broad range of on-demand requests from the management body or competent authorities;

(e) ensure sound, reliable and secure functioning of information and communication systems supporting the targeted activities of institutions.

184. With regard to ICT and security risk 63, competent authorities should be satisfied that the management framework will ensure the sound, reliable and secure functioning of information and communication systems supporting the activities of credit institutions as well as the adequate prevention, monitoring and mitigation of ICT risks at normal times and during times of stress. Competent authorities should assess, in particular:

(a) whether the management body has overall accountability for setting, approving and overseeing the implementation of financial institutions’ ICT strategy, which should be aligned with financial institutions’ overall business strategy;

(b) the clear definition and attribution of key roles and responsibilities, and relevant reporting lines, for the ICT and security risk management framework to be effective, including the allocation of appropriate budget to adequately support the ICT operational needs and the ICT and security risk management;

(c) whether the management and oversight of ICT and security risks are entrusted to an independent and objective control function, appropriately segregated from ICT operational processes and not responsible for any internal audit, and an independent internal audit function;

(d) the arrangements to ensure the identification, establishment and maintenance of updated mapping of business functions, roles and supporting processes to identify the importance of each and their interdependencies in relation to ICT and security risks;

(e) to the extent that the information is held on ICT systems, whether the requirements for information security will be in place;

(f) the scale, complexity and importance of ICT-related dependencies, if the outsourcing of operational functions of ICT services and any activity of ICT systems – including to group entities – or the use of third parties in relation to such functions and activity is envisaged.

[63] As defined in the EBA Guidelines on ICT security risk management, ‘ICT and security risk’ means: ‘Risk of loss due to breach of confidentiality, failure of integrity of systems and data, inappropriateness or unavailability of systems and data or inability to change information technology (IT) within a reasonable time and with reasonable costs when the environment or business requirements change (i.e. agility). This includes security risks resulting from inadequate or failed internal processes or external events including cyber-attacks or inadequate physical security’.

10.Qualifying holdings and members

185. For the purposes of Article 14(1) 64 CRD, competent authorities should examine the information relating to shareholders and members submitted by the applicant credit institution in accordance with Articles 8 and 9 of the RTS on information for authorisation.

186. For the purposes of Article 14(2) 65 CRD, competent authorities should assess the compliance of shareholders and members with the criteria set out in Article 23(1) CRD as further specified in the ESAs’ Joint Guidelines on the prudential assessment of qualifying holdings66.

[64] The provision reads: ‘1. The competent authorities shall refuse authorisation to commence the activity of a credit institution unless a credit institution has informed them of the identities of its shareholders or members, whether direct or indirect, natural or legal persons, that have qualifying holdings and of the amounts of those holdings or, where there are no qualifying holdings, of the 20 largest shareholders or members. […]’.

[65] The provision reads: ‘Competent authorities shall refuse authorisation to commence the activity of a credit institution if, taking into account the need to ensure the sound and prudent management of a credit institution, they are not satisfied as to the suitability of the shareholders or members, in accordance with the criteria set out in Article 23(1). Article 23(2) and (3) and Article 24 shall apply’.

[66] JC/GL/2016/01 of 20 December 2016, available at https://esas-joint-committee.europa.eu/Publications/Guidelines/JC_QH_GLs_EN.pdf

Annex – Figures on determination of capital at authorisation and amount to be paid up

Figure 1. The own funds requirement is higher than the initial capital

Initial capital
(under national law )
Own funds requirements at the end of the year (includes yearly losses and RWA increase) * Cumulated yearly losses* Year 1 Year 2 Year 3 10 10 10 2
3.5
4
15
18
22
Amount of capital at authorisation to be paid up Total capital at authorisation (paid up, plus funding sources) 15 22

[*] Determined in accordance with the review of the business plan under section 7.2.6

Figure 2. Initial capital under national law is higher than the own funds requirement

Year 1
Year 2
Year 3
10
10
10
2
3.5
4
6
8
12
Amount of capital at authorisation to be paid up Total capital at authorisation (paid up, plus funding sources) 12 14 Initial capital (under national law ) Own funds requirements at the end of the year (includes yearly losses and RWA increase) * Cumulated yearly losses*

[*] Determined in accordance with the review of the business plan under section 7.2.6

Figure 3. Change in the higher amount in the course of the three-year plan

Year 1
Year 2
Year 3
10
10
10
2
3.5
4
6
8
25
Amount of capital at authorisation to be paid up Total capital at authorisation (paid up, plus funding sources) 12 25 Initial capital (under national law ) Own funds requirements at the end of the year (includes yearly losses and RWA increase) * Cumulated yearly losses*

[*] Determined in accordance with the review of the business plan under section 7.2.6

11.Accompanying documents

11.1 Draft cost-benefit analysis

1. As per Article 16(2) of Regulation (EU) No 1093/2010 (EBA Regulation), any guidelines and recommendations developed by the EBA shall be accompanied by an Impact Assessment (IA) which analyses ‘the potential related costs and benefits’.

2. This analysis presents the IA of the main policy options included in these Guidelines on a common assessment methodology for granting authorisation as a credit institution as per Article 8(5) of Directive (EU) 2019/878.

3. The IA is high-level and qualitative in nature.

A. Problem identification and background

4. Article 8(1) CRD requires Member States to subject credit institutions to prior authorisation before commencing their activities. In particular, the same article states that, without prejudice to Article 10 to 14 CRD, specific requirements for authorisation should be set by the individual Member States.

5. Articles 10 to 14 CRD set out common requirements for granting the authorisation as a credit institution, namely a programme of operations, the organisational structure and governance arrangements, initial capital, effective direction of the business and place of the head office, shareholders and members. Articles 8(2) and 8(3) further mandate the EBA to develop RTS and ITS on the information to be provided by applicants to their respective competent authorities and the templates to be used, which were submitted to the European Commission for endorsement and were published on 14 July 201767.

6. The EU framework referred to above does not provide for common guidance on the actual assessment of credit institutions’ applications and there is to date no common assessment methodology (CAM) to be used by competent authorities in their authorisation processes. This may lead to potentially very different practices across Member States when considering applications for credit institutions and therefore hinders a level playing field in terms of the authorisation of credit institutions across the EU. Whilst the exclusive competence to grant authorisations entrusted to competent authorities is a significant factor in fostering convergence of practices, divergences still remain across the EU.

[67] EBA/RTS/2017/08 and EBA/ITS/2017/05, available at https://eba.europa.eu/regulation-and-policy/other-topics/rts-and-its-on-the-authorisation-of-credit-institutions

7. The new Article 8(5) of CRD IV (Directive (EU) 2019/878) now mandates the EBA to develop guidelines addressed to the competent authorities to specify a CAM for granting authorisations in accordance with this Directive.

B. Policy objectives

8. The Guidelines in this consultation paper developed under the mandate of Article 8(5) aim at fostering the level playing field in terms of the authorisation process of credit institutions across the EU, by establishing guidance on a CAM for the authorisation requirements set out in Articles 10 to 14 CRD. Initial costs to competent authorities are assessed as limited in the form of implementation of the methodologies, whilst in the long run a more structured and homogeneous CAM should imply more efficient and effective assessment processes, reducing the burden on both competent authorities and credit institutions.

9. Several issues can be identified in the level 1 text that may lead to differences in the interpretation and application and hinder consistent authorisation practices across Member States. One key issue relates to the national interpretation of certain elements of the notion of a credit institution set out in Article (4)(1), point (1), letter (a) CRR. Any change to or harmonisation of national interpretations and applications may, however, have material impacts on the regulatory perimeter at national level.

10. Therefore, for the purposes of these Guidelines, it has been acknowledged that a solution to the issue of the notion of a credit institution is out of scope and that this would need to be addressed in a separate exercise. The matter has instead been raised in an EBA Opinion in September 202068, pointing to the need for a discussion of the topic in the context of the level 1 revision and potentially a more in-depth IA.

C. Options considered, assessment of the options and preferred options

11. Section C. presents the main policy options discussed and the decisions made during the drafting of the Guidelines. Advantages and disadvantages of the policy options and the preferred options resulting from this analysis are assessed below.

Investment firms

Option 1a: a separate CAM to be developed for undertakings applying for authorisation as credit institutions in accordance with Article 8a CRD

Option 1b: the CAM laid down in these Guidelines to apply to the extent relevant to undertakings applying for authorisation as credit institutions in accordance with Article 8a CRD

[68] See EBA Opinion on elements of the definition of credit institution under Article 4(1), point 1, letter (a) of Regulation (EU) No 575/2013 and on aspects of the scope of authorisation (18 September 2020)

12. In accordance with Article 8a CRD, undertakings meeting one of the conditions set out in Article 4(1)(1)(b)(i)–(iii) CRR have to apply for an authorisation as a credit institution. Irrespective of whether they are existing investment firms or new undertakings (falling within one of the conditions set out Article 4(1)(1)(b)(i) or (ii) CRR), such entities need to file an application as a credit institution with the competent authority, and the latter should review the application and assess whether the authorisation should be granted. The policy question relevant in this regard is whether the CAM applied by the reviewing competent authority needs to be defined and set out differently for applications submitted under Article 4(1)(1)(a) and (b) CRR.

13. Having specific regard to investment firms that have to apply to be reauthorised as credit institutions, it should be taken into account that they are somewhat different in nature to credit institutions, notably they do not take deposits or other repayable funds and are already well-established players in the market.

14. At the same time, to the extent that both types of applicants are granted the authorisation as a credit institution, competent authorities have to assess and review compliance with the same requirements set out in Article 10–14 CRD during the assessment process. For this reason, it has been considered that undertakings applying for authorisation as a credit institution should be subject to the same CAM laid down for ‘traditional’ applicant credit institutions to the extent possible. This means that competent authorities should apply these same Guidelines to the extent relevant to credit institutions defined in Article 4(1)(1)(b) CRR. Option 1b has therefore been chosen as the preferred option. Applicability of the same CAM across the two applicant types should limit the costs to competent authorities and applicant credit institutions, ensuring simplicity and clarity.

Technology neutrality

Option 2a: no separate section on the treatment of innovative business models and/or delivery mechanisms (e.g. fintech banks)

Option 2b: the Guidelines to distinguish between traditional and innovative business models and/or delivery mechanisms

15. The technological and business model landscape of credit institutions is changing fast today, and with it the landscape of incoming applicant credit institutions. Whilst consideration and assessment of an applicant credit institution’s business model are key in the authorisation process, the Guidelines have remained technology-neutral in their drafting. This means that, whilst as part of the authorisation process it is crucial for competent authorities to reflect on the business model and whether it may potentially hinder effective supervision, no technology, business model or delivery mechanism has been excluded or been given preference in the Guidelines. Choosing Option 2a, giving no separate treatment to fintech banks as the preferred option, has been a conscious decision as technological innovation is present everywhere today and the emergence and development of new structures and technologies should not be hampered.

The amount of capital at authorisation

Option 3a: initial capital to be required as per Article 12 CRD, plus expected annual losses for the first three years.

Option 3b: the higher of i) the initial capital as per Article 12 CRD plus the expected losses for the first three years, ii) the own funds requirements as determined through the base case scenario and a severe but plausible stress scenario for the business plan over at least three years (which includes expected annual losses for the first three years and the RWA increase).

16. Article 12 CRD sets out the minimum initial capital of EUR 5 million that needs to be in place for a credit institution to commence its activities69. This has led to varying implementation of Article 12 across Member States, with minimum initial capital levels ranging from EUR 5 million to EUR 18 million.

17. Acknowledging the flexibility of the level 1 text that only provides for a minimum initial capital amount, leaving Member States able to set the actual absolute amount, the Guidelines aim to ensure a consistent level of capital at authorisation. The latter is achieved by considering both the initial capital amount set out in national law plus the expected annual losses for the first three years, as well as the own funds requirements determined for each applicant credit institution on the basis of the base case and severe but plausible stress scenario for the business plan assessed by the competent authority (which include the expected annual losses for the first three years and the RWA increase). The proposed methodology ensures that a credit institution is able to meet its own funds requirements at the time of authorisation and for the foreseeable future, i.e. over a three-year time horizon.

18. By selecting the higher of the initial capital set out by the Member States (plus the expected annual losses for the first three years) and the own funds requirements determined on a case-by-case basis (which include the expected annual losses for the first three years and the RWA increase), the Guidelines increase the level of harmonisation of credit institutions’ capital when starting their activities. Under this approach, the level 1 minimum initial capital amount as per Article 12 is respected, including the various national practices relating to the actual minimum amount required. At the same time, a common level of prudence is ensured through the own funds calculations and the ‘higher of’ condition. Option 3b has been chosen since it ensures a higher degree of harmonisation and prudence on capital levels than when observing a wide range of initial capital levels across Member States. This option will considerably improve the level playing field, adding comparability and consistency.

Internal governance considerations in the application process

Option 4a: the Guidelines to exclusively cross-refer to existing level 2 regulatory products to identify internal governance requirements to be assessed at the authorisation stage

[69] For the sake of completeness it is worth noting that the same provision in paragraph (4) further provides that Member States may envisage that certain categories of credit institutions may be granted authorisation when the initial capital is below EUR 5 million but at least EUR 1 million and certain conditions are met.

Option 4b: the Guidelines to identify the most important aspects on internal governance to be assessed by the competent authorities at the authorisation stage

19. Numerous level 2 regulatory products deal with various aspects of internal governance in the form of guidelines and technical standards. From a drafting perspective, when developing new policy products, often existing guidance is simply cross-referenced, in order not to duplicate regulatory products and create too many sources of information for the reader with little additional added value.

20. Also in the case of the Guidelines on the CAM, several internal governance aspects are at play and need to be linked to existing guidance on the topic. In this case, a policy choice has been made against merely cross-referencing to such existing regulatory products for all aspects concerned. Rather, Option 4b has been chosen as the superior option. The reason for this choice has been the somewhat different nature of the authorisation process: existing regulatory products refer to going-concern situations (i.e. existing structures), whilst authorisation is about laying down the structure and internal relations within the credit institution. Existing guidelines and standards on internal governance therefore contain parts that are not fully fit for the purpose of the authorisation stage. Hence, the Guidelines at hand have identified the most important aspects on internal governance to be assessed by competent authorities at authorisation, instead of merely cross-referencing to existing products. Such a policy approach, however, is without prejudice to the application of additional parts of the relevant level 2 products, should this be deemed appropriate by the competent authority.

21. Importantly, identifying the most important aspects significantly improves the level playing field, since it fosters the convergence of the competent authorities’ assessment on common aspects identified in the Guidelines without prejudice to the assessment of additional parts. (For some areas, such as the suitability assessment of directors and key function holders, a complete cross-reference to the existing guidelines has been considered appropriate, since the type of supervisory assessment does not change depending on the stage of the lifecycle of the institution, i.e. at authorisation or as a going concern.)

22. Choosing Option 4b will considerably enhance the transparency and clarity of the assessment process, presenting clear practical benefits for both competent authorities and applicant credit institutions.

D. Conclusion

23. The Guidelines have been drafted with a view to harmonising the assessment methodology used by competent authorities for granting the authorisation of credit institutions. The Guidelines lay down a common assessment methodology addressed to the competent authorities for the assessment of applications for granting the authorisation as a credit institution. Whilst some important aspects (some elements of the notion of credit institutions) cannot be addressed as part of this policy document, the Guidelines aim to foster as much as possible the level playing field as regards the assessment methodology for considering the necessary requirements to be met in order to grant the authorisation. Careful consideration has been given to balancing existing national practices with more homogeneous practices and frameworks to be used at the Union level, and the Guidelines ensure sufficient flexibility remains so as not to hinder the creation and preservation of a functioning and innovative market for credit institutions. In addition, due consideration has been given to balancing any potential added complexity for competent authorities and applicant credit institutions with ensuing benefits for the assessment process and the system as a whole.

24. The Guidelines represent an important step towards deeper integration and further levelling of the playing field in the European banking sector.

11.2 Overview of questions for consultation

Question 1: Are subject matter, scope of application and definitions appropriate and sufficiently clear?

Question 2: The Guidelines clarify that competent authorities should cooperate with AML supervisors when granting the authorisation. They also expressly specify that ML/TF risk is part of the risks to be assessed by the competent authorities, and expressly refer to ML/TF throughout the text. Are these references sufficiently clear?

Question 3: Are the requirements and limits for imposing conditions precedent, obligations subsequent and restrictions sufficiently clear?

Question 4: To ensure the sound and prudent management of the credit institution, all activities likely to impact on the prudential treatment of the applicant credit institution should be assessed by the competent authority. Is this concept sufficiently clear with regard to applicants carrying on activities in addition to banking and financial activities?

Question 5: Is the approach towards the assessment of the application submitted by undertakings meeting one of the conditions in Article 4(1)(1)(b)(i)–(iii) CRR appropriate and sufficiently clear?

Question 6: Are the main focus areas, the level of granularity and the specific technical aspects of the business plan assessment appropriate and sufficiently clear?

Question 7: Are the elements for the determination of capital at authorisation and the determination of the amount to be paid up at the moment of the authorisation sufficiently clear?

Question 8: The approach taken by these Guidelines as regards the CAM for the internal governance is to directly indicate the minimum main elements and aspects required for the assessment based on the requirements laid out in relevant EU regulatory acts. This selective approach, however, is without prejudice to the application by the competent authorities of additional parts of the various EBA Guidelines which may be relevant for the assessment of the applicant’s internal governance. Is this approach sufficiently clear?

11.3 Views of the Banking Stakeholder Group (BSG)

The Banking Stakeholder Group participated in the public consultation by submitting an Opinion70, focusing in particular on the scope of the proposed activities to be carried out by the credit institution. The BSG underscored the need for clarity as to the applicant’s intention to carry out activities other than banking activities and the related applicable regime (if any), also in terms of authorisation or registration requirements. With specific regard to the applicant credit institution

[70] Available at https://www.eba.europa.eu/about-us/organisation/banking-stakeholder-group/publications

plan to undertake investment services activities, the BSG draws attention to the competent authorities’ consideration of the related risks before granting the authorisation.

The BSG welcomed the explicit inclusion of AML/TF risks in the draft Guidelines, supported the references included in the draft Guidelines and proposed additional clarifications.

The BSG suggested that the grounds for refusal of authorisation should include market integrity and consumer/investor protection. The BSG also suggested that a fast-track procedure should be introduced for the assessment of applicant credit institutions belonging to a group supervised by competent authorities.

Finally, the BSG proposed various amendments in relation to the business plan analysis and the internal control sections.

11.4 Feedback on the public consultation and on the opinion of the BSG

The EBA publicly consulted on the draft proposal contained in this paper.

The consultation period lasted for three months and ended on 10 June 2021. Four responses were received, of which three were published on the EBA website.

This paper presents a summary of the key points and other comments arising from the consultation, the analysis and discussion triggered by these comments and the actions taken to address them if deemed necessary.

In some cases respondents made similar comments or the same respondent repeated its comments in the response to different questions. In such cases, the comments and EBA analysis are included in the section of this paper where the EBA considers them most appropriate.

Changes to the draft Guidelines have been incorporated as a result of the responses received during the public consultation.

11.5 Summary of key issues and the EBA’s response.

Some comments expressed the view that several parts of the CAM – including AML/CFT, business plan analysis, own funds requirements, internal governance – go beyond the authorisation requirements and lack legal basis. The EBA has examined these comments but considers that such aspects fall within the authorisation requirements, not only because they are covered by Articles 10-14, 23 CRD, but also because the credit institution has to be able to comply with prudential requirements as of the first day of access to the market. After careful examination, the EBA has therefore considered it opportune not to take these comments on board.

One comment pointed out that the paragraphs relating to the notion of ‘deposits and other repayable funds from the public’ may affect the issuance of corporate bonds. The EBA has carefully examined this comment, and acknowledges that the notion of ‘other repayable funds’ is broad and is not sufficiently specified in the definition of credit institution set out in letter (a) of point (1), of Article 4(1) CRR. The EBA notes that it last drew attention to this matter in the Opinion of 18 September 2020. In the light of this the Guidelines do not purport to lay down a definition of ‘deposits or other repayable funds from the public’, but are limited to drawing attention to core elements. The EBA has also noted that the Guidelines do not aim at extending the authorisation requirement to those undertakings which do not pursue a banking business model and for which an authorisation as a credit institution is not necessary. In the light of the above, no amendment to the text has been made.

Some comments concerned the activities that applicant credit institutions plan to carry out and suggested that the Guidelines should expressly clarify that those governed by legal acts other than the CRD should be assessed by the applicable regime. The EBA’s view is that, whilst the comment is in principle correct, the assessment methodology does not go as far as assessing the conduct of the services provided. In addition, the section on business plan analysis in the part relating to the business strategy expressly mentions the need to identify all targeted activities, including with a view to assessing the need for other regulatory requirements. In the light of this consideration among others, the EBA concluded that no change to the text of the Guidelines was required.

The need for an additional focus on AML/CFT was pointed out by one stakeholder, in particular in the context of proportionality criteria and business plan analysis. The EBA examined the comment and is of the view that whilst AML/CFT assessment requirements are sufficiently addressed in the context of the business plan analysis, specific attention in the context of the proportionality principle needed to be emphasised.

One stakeholder observed that the assessment of all activities likely to impact on the prudential treatment of the applicant credit institution was not sufficiently clear in the draft Guidelines and that it could imply that all the activities that are not banking and financial services, and which therefore are not subject to prudential supervision, would come under supervisory assessment for the purposes of granting the authorisation. The EBA has carefully examined this comment and considers that the purpose of the assessment is not the assessment of the activity per se, but the potential prudential impacts on the credit institution. As a consequence, the text has been clarified.

Summary of responses to the consultation and the EBA’s analysis

Comments	Summary of responses received	EBA analysis	Amendments to the proposals
General comments	Applicants belonging to banking groups: creation of a fast-track assessment procedure
Applicants belonging to groups	Stakeholders suggested creating a fast-track approach for the authorisation of already licensed credit institutions that are seeking only an additional licence (hence differentiating the level of requirements between new market players and entities already providing financial services) or for an applicant credit institution belonging to a group which is subject to the consolidated supervision of a competent authority. One stakeholder observed that additional consideration should be given by the draft Guidelines when applying the principle of proportionality, with particular reference to criteria under paragraph 18 letter m) and small credit institutions that belong to a large group which is subject to consolidated supervision. The comment pointed out that in this case no stricter assessment criteria should be imposed on small credit institutions belonging to a group subject to consolidated supervision, in order to comply with the principle of proportionality where small credit institutions not belonging to a group would undergo criteria of a different level.	The mandate for the development of the Guidelines is set out in Article 8(5) CRD, which exclusively focuses on the assessment methodology and not on the process for granting the authorisation, as the creation of a fast-track procedure would be. However, the Guidelines contain a number of provisions that consider a proportionate approach to the case at hand. Paragraph 18, letter m) refers to ‘whether the applicant credit institution belongs to a group which is subject to the consolidated supervision of the competent authority’. The Guidelines also specify that in the case of paragraph 18, letter m), and in line with Article 10(1) of the RTS on information for authorisation, the intensity of the assessment should take into account the competent authority’s direct knowledge – based on information available to it – of the business model, risk profile and current prudential, financial, business and operational conditions of the applicant credit institution or group. Furthermore, with regard to credit institutions authorised on the basis of an ‘activity-by-activity’ authorisation, paragraph 20 of the Guidelines, in line	No change.
		with the principle of proportionality, expressly provides that the competent authority’s assessment for the extension of such authorisation to include additional activities should be limited in scope and focus ‘on the impact of the new additional activities on the overall business model and on the capacity to comply with prudential requirements’.
Scope of the authorisation	A respondent suggested that competent authorities need to have clarity on the extent to which authorisation as a credit institution takes account of the applicant’s intention to carry out activities other than banking activities and the regulatory regime (authorisation, registration, etc.) applicable to such other activities. Besides, if an applicant credit institution plans to undertake investment services activities or other activities such as the provision of payment services, competent authorities need to be able to consider the related risks before making decisions on authorisations.	This point is reflected in paragraph 44 of the Guidelines, providing that the assessment of the application for authorisation as a credit institution should cover all the activities envisaged by the applicant credit institution in the programme of operations, including those that go beyond the taking of deposits or other repayable funds from the public and granting credit on own account, regardless of whether they are set out in Annex I CRD or further activities pursuant to national law. Furthermore, paragraph 75 – in section 7 relating to the assessment of the business plan – requires competent authorities to achieve a clear view on the activities covered by the authorisation, including in order to assess the need for other suitable authorisation regimes.	No change.

Responses to questions in Consultation Paper EBA/CP/2021/07

Question 1. Are subject matter, scope of application and definitions appropriate and sufficiently clear?

Comments	Summary of responses received	EBA analysis	Amendments to the proposals
Appropriateness of the scope	One stakeholder observed that the draft Guidelines extend the authorisation requirements beyond those established in the legal texts.	The Guidelines are compliant with the mandate set out in Article 8(5) CRD, and cover all the authorisation requirements set out in the EU legal framework, namely Articles 10–14 CRD, relating to the programme of operations, the operational structure, the capital requirements, the effective direction, the shareholders and members and the assessment of qualifying holdings.	No change.
Notion of ‘other repayable funds’	A respondent expressed the concern that a broad understanding of the notion of ‘other repayable funds’ as outlined in paragraph 52 of the draft Guidelines would affect corporates’ ability to raise money in the capital market without the notion of ‘repayable funds’ applying and hence the need of an authorisation. The respondent suggested that the draft Guidelines should explicitly exclude the issuance of corporate bonds from the definition of deposit-taking activity in any further future consideration on the harmonisation of the definition of ‘deposits’ and ‘other repayable funds’. Otherwise, the EBA would exceed its mandate.	The EBA acknowledges that the notion of ‘other repayable funds’ is broad and is not sufficiently specified in the definition of a credit institution set out in Article 4(1)(1)(a) CRR. The EBA notes that it has drawn attention to this matter most recently in the Opinion of 18 September 2020 on elements of the definition of credit institution under Article 4(1)(1)(a) of Regulation (EU) No 575/2013 and on aspects of the scope of the authorisation. For this reason, paragraph 46 of the draft Guidelines does not purport to lay down a definition of such a notion, but is limited to indicating to the competent authorities core aspects of such elements and requiring competent authorities’ special attention when assessing the application. This high-level approach is further confirmed by paragraph 55 of the draft Guidelines, providing that competent authorities should also consider whether the authorisation as a credit institution is required by the underlying situation and current circumstances of the applicant, and assess the adequacy and necessity of the authorisation, having	No change.
		regard to the activities that the applicant credit institution intends to carry out. Therefore, the mere issuance of corporate bonds by companies outside the financial sector (corporates) does not per se trigger the requirement for an authorisation as a credit institution.
Question 2. The Guidelines clarify that competent authorities should cooperate with AML supervisors when granting the authorisation. They also expressly specify that ML/TF risk is part of the risks to be assessed by the competent authorities, and expressly refer to ML/TF throughout the text. Are these references sufficiently clear?
Lack of legal basis to assess a credit institution application based on AML/CFT-related aspects too	One stakeholder submitted that there is a lack of a legal requirement for authorisation as a credit institution to be assessed with respect to AML/CFT risks, hence the absence of a legal mandate to include related assessment criteria in the draft Guidelines in this respect.	These Guidelines take a risk-based approach and include ML/TF risk within the concept of risks, to be considered in the context of the assessment of the application for granting the authorisation by competent authorities. To note also that ML/TF risk is expressly referred to Article 23(1)(e) CRD on the prudential assessment of acquisition of qualifying holdings, as well as in other EBA Guidelines, such as the Guidelines on internal governance under Directive 2013/36/EU (i.e. paragraph 75) which are also applicable in the authorisation context.	No change.
AML/CFT and principle of proportionality	A respondent suggested that paragraph 18 of the draft Guidelines should include a new point referring to ‘the AML/CFT risks inherent in the business activities the specific credit institution plans to carry out and the AML/TF risk profile of the jurisdictions in which it intends to offer services’.	For the purposes of these Guidelines, references to risk also include ML/TF risk. Competent authorities should therefore comprehensively assess AML/CTF-related aspects for the purposes of granting the authorisation. Paragraph 18 lays down the criteria that have to be taken into account for the application of the principle of proportionality: ‘b) the expected geographical presence of the applicant credit institution and the size of its operations in each jurisdiction; […] f) the business model (including its	No change.
Comments	Summary of responses received	EBA analysis	Amendments to the proposals
		innovative character, uniqueness or complexity) and strategy, as well as the expected level of risk stemming from the implementation and execution; the nature and complexity of the targeted business activities’. Furthermore, specific assessment criteria enshrine the suggested principle. Application of proportionality to ML/TF risk may have a negative impact, with potential underestimation of the ML.TF risk.
Business plan analysis	A respondent suggested that it would be useful to make an explicit connection between the extent of the inherent risk in the credit institution’s planned activities and the assessment of whether controls are sufficient and appropriate to manage the level of risk.	This concern is addressed by paragraph 132 of the Guidelines, which provides that the intensity of the competent authorities’ assessment of internal governance requirements should be tailored to the applicant’s individual risk profile. For the purposes of these Guidelines, references to risk also include AML/TF risk.	No change.
Question 3. Are the requirements and limits for imposing conditions precedent, obligations subsequent and restrictions sufficiently clear?
Common assessment methodology	A respondent was concerned that the grounds for refusing authorisation are limited to prudential concerns and exclude grounds for market integrity or investor/consumer protection reasons. A respondent expressed the concern that paragraph 16 of the draft Guidelines does not allow competent authorities, for example, to refuse the authorisation to an applicant where the business model depends on highly irresponsible consumer lending practices or which depends on an activity which presents high ML/TF risk, without demonstrating any convincing plans or resources for managing the risk. They	The objective of paragraph 16 of the Guidelines is to restrict competent authorities’ assessment to technical and prudential considerations, and to exclude business or policy judgments. The section on business plan assessment of the Guidelines expressly requires to identify whether the sectors, activities, products, target customers, geography and distribution channels present a higher level of ML/TF risk. Furthermore, the draft Guidelines underscore the importance that the organisational	No change.
	suggested that paragraph 16 take account of the possibility for refusal to be grounded in market integrity, consumer or investor protection concerns relevant to the proposed plan of operation of the applicant credit institution.	structure, internal governance framework and control be commensurate with the business plan, so as to ensure that the credit institution will be able to perform the targeted activities in a sound and prudent manner. In this regard, it is worth remembering that an express ground of refusal of authorisation is set out in Article 10(2) CRD whenever the competent authorities are not ‘satisfied that the arrangements, processes and mechanisms referred to in Article 74(1) [CRD] enable sound and effective risk management by that institution’.
Legal basis for conditions precedent, obligations subsequent and restrictions	One respondent questioned the legal basis for imposing conditions precedent, obligations subsequent and restrictions. In particular, it observed that secondary law foresees neither conditional authorisations nor restrictions. Hence this may result in a high level of legal uncertainty as any requirements imposed based on the draft Guidelines may not be legally binding whenever decisions adopted on this basis are challenged in court.	The Guidelines do not introduce the power to impose conditions precedent, obligations subsequent and restrictions, but build upon existing powers within national law. The imposition of such elements at any rate is at the discretion of the competent authority and is subject to the fulfilment of all authorisation requirements by the applicant. The purpose of the draft Guidelines is to harmonise the circumstances and the requirements for the exercise of such powers. The decision on the ancillary elements is made in a risk-based approach and in a case-by-case assessment. The power to impose such ancillary elements in an approval decision is in line with the case law of the Court of Justice71.	No change.
Restrictions	A respondent suggested that paragraphs 30 and 31 of the draft Guidelines should clearly state that if a	The assessment of an application for authorisation as a credit institution should cover all the activities	No change.

[71] Judgment of the Court of Justice of 25 June 2015, CO Sociedad de Gestión y Participación SA and Others v De Nederlandsche Bank NV and Others, C-18/14, ECLI:EU:C:2015:419.

Comments	Summary of responses received	EBA analysis	Amendments to the proposals
	competent authority assesses that an applicant credit institution is unlikely to be able to comply with the requirements in relation to activities which are regulated under other legislation, notably MiFID II, the Consumer Credit Directive, Mortgage Credit Directive and Payment Services Directive, the credit institution’s licence should be limited.	envisaged by the applicant credit institution in the programme of operations, including those that go beyond the taking of deposits or other repayable funds from the public and granting credit on own account, regardless of whether they are set out in Annex I CRD or further activities pursuant to national law. The Guidelines also specify that the competent authorities’ assessment should aim at ensuring the compliance of the newly licensed credit institution with prudential requirements as of the first day of access to the market.
Supervisory guidance	With regard to paragraph 32, a respondent suggested replacing the wording ‘despite not being legally binding’ with ‘even where not legally binding’ because some of the matters signalled by competent authorities may relate to aspects of the firm’s legal obligations which were not capable of being fully evidenced at authorisation.	The authorisation is granted when all requirements are met and it may not be granted if there is a gap with legal obligations. As a result, guidance provided by competent authorities at authorisation exclusively relates to specific areas of supervisory focus with a view to making its expectations transparent.	No change.
Question 4. To ensure the sound and prudent management of the credit institution, all activities likely to impact on the prudential treatment of the applicant credit institution should be assessed by the competent authority. Is this concept sufficiently clear with regard to applicants carrying on activities in addition to banking and financial activities?
Scope of assessment and consistency with ongoing supervision	One stakeholder observed that the concept of assessing all activities likely to impact on the prudential treatment of the applicant credit institution is not sufficiently clear. It could potentially imply that all the activities that are not banking and financial services, and which therefore	Paragraph 44 of the Guidelines limits itself to indicating that, when assessing the application, competent authorities should consider the potential impact of all activities to be carried out by the applicant credit institution. The indicated assessment will therefore not be focussed on the activity per se	Drafting clarified.
	are not subject to prudential supervision, would come under supervisory assessment for the purposes of granting the authorisation.	(which, depending on the activity, could be outside the scope of competent authorities’ competence) but on its impact on prudential requirements.
Financial activities	A respondent suggested that paragraph 44 of the draft Guidelines could be clearer about how the financial activities which are listed in Annex 1 CRD but substantively regulated by EU directives and regulations other than CRR/CRD will be reflected in the decision on whether to authorise the applicant.	The assessment for granting the authorisation is risk-based, accordingly the assessment of the activities that the applicant intends to carry out focuses on the analysis of the business plan, from a risk-based, regulatory prudential requirements and internal governance perspective. The latter aims at ensuring the consistency of and correspondence between the envisaged activities and the internal organisation of the applicant and the absence of elements that could prevent the effective exercise of their supervisory functions.	No change.
Situation where an authorisation is required	One stakeholder observed that paragraphs 35 and 41 of the draft Guidelines go beyond the EBA mandate set out in Article 8(5) CRD. Such a mandate is limited to the specification of a common assessment methodology for granting authorisation and should not go so far as envisaging additional triggers for authorisation in case of a merger of two or more credit institutions (paragraph 35) and /or authorisation when a credit institution changes its legal form. Finally, it was observed that point 4.3 may contradict applicable national law.	The mandate set out in Article 8(5) CRD requires the EBA to develop a common assessment methodology for granting authorisation. The clarification of cases such as mergers and material changes, i.e. those other than first-time application, where an authorisation is required is an integral part of the methodology to ensure a level playing field in the EU for market access.	No change.
Remuneration policy (paragraph 135, letters b and g,	Reference has been made to practices implemented in certain Nordic countries where remuneration structures are negotiated not only by the	With regards to remuneration policy, further specifications can be found in the EBA Guidelines on sound remuneration policies under Article 74(3) and	No change.
Comments	Summary of responses received	EBA analysis	Amendments to the proposals
and section 9.4.3, paragraphs 170 and 171)	competent authority and the management body of the institution but also by social partners and trade unions. The comment suggested including the reference to the negotiation being part of the process to determine the remuneration structure.	75(2) of Directive 2013/36/EU and disclosure under Article 450 of Regulation (EU) No 575/2013. Although the EBA appreciates and values the different national frameworks through which salaries are negotiated, it notes that this subject is outside the scope of the mandate.
Question 5. Is the approach towards the assessment of the application submitted by undertakings meeting one of the conditions in nos. (i)–(iii) of letter 1(b) of Article 4(1) CRR appropriate and sufficiently clear?
Legal basis of proposed assessment approach	One stakeholder argued the absence of a legal basis for the assessment laid down in section 5 of the draft Guidelines.	The mandate set out in Article 8(5) CRD relates to granting authorisation as a credit institution. As a consequence of the enactment of Regulation (EU) 2019/2033 on the prudential requirements of investment firms, Article 4(1), point (1) CRR setting out the traditional definition of credit institution in letter (a), has been amended so to include, a new typology of credit institution as defined in letter (b) thereof. Therefore, the common assessment methodology applies to both legs of the definition of credit institution laid down in letter (a) and in letter (b) of Article 4(1), point (1) CRR.
Question 6. Are the main focus areas, the level of granularity and the specific technical aspects of the business plan assessment appropriate and sufficiently clear?
Business plan analysis	A respondent suggested that the scope of paragraph 67 should be broadened to allow for other regulatory objectives, namely market integrity and consumer protection, to be considered in the context of the assessment depending on the applicant’s target activities.	The Guidelines underscore the importance of the organisational structure, internal governance framework and control being commensurate with the business plan, so as to ensure that the credit institution will be able to perform the targeted activities in a sound and prudent manner. With regard to market integrity, the draft Guidelines draw specific	No change.
		attention, among other aspects, to the assessment of ML/TF risk in various parts of the assessment (business plan, internal governance, capital, liquidity, etc.). As to consumer protection, the assessment of the outline of a consumer protection policy is dealt with from the perspective the governance arrangements, where reference is also made to the assessment of the outline on product governance.
Clarity and proportionality in the information requested for the assessment of the business plan	One response observed that the information requested in relation to the assessment of the business plan appears not to be sufficiently clear nor proportionate. In particular, the comment highlighted that the draft Guidelines go beyond the definition of Article 10(1) CRD in terms of the programme of operations and types of business envisaged by the applicant credit institution. Concern has been expressed as to the request that the applicant credit institution should self-assess the financial projections, viability and sustainability of the proposed business model, pointing out that the assessment of economic needs of the market is explicitly excluded from the application procedure according to Article 11 CRD. Another similar comment suggested, in relation to the assessment of the business strategy, that competent authorities should also respect economic management decisions as per Article 11 CRD.	The section relating to the analysis of the business plan lays down the expectations of competent authorities which are fully consistent with the information requested for the business plan under the RTS on information for authorisation as a credit institution. Under a risk-based approach is it standard practice for a business plan to lay down financial projections, and that the overall plan be sustainable. The assessment of these features does not impinge upon the prohibition of assessment of the economic needs of the market, but rather, consistently with Article 11 CRD, is a purely technical assessment. The importance of not intruding into the economic needs of the market is restated in paragraph 16 of the Guidelines providing that competent authorities’ assessment should be only technical. In addition, paragraph 69 of the Guidelines clearly states that competent authorities should refrain from indicating preferences for specific business models and be neutral as to the business needs of their jurisdiction.

Comments	Summary of responses received	EBA analysis	Amendments to the proposals
Concerns in relation to the formulation of paragraph 105, relating to financial forecasts, in the part on recurring cost concentration	One respondent pointed out that paragraph 105 lends support to the view that the EBA encourages institutions to favour flexible salary structures over fixed ones, in order to be classified as lower-risk institution. This approach would instead result in a higher risk profile for the institution as variable pay structures, as shown in the past, have incentivised risky business practices.	It is important to consider the context in which paragraph 105 is included, which is in section 8.2.5. dedicated to ‘financial forecasts’. Also, paragraph 105 should not be assessed alone but in the context of the requirements for the financial forecasts. The intention of paragraph 105 is not to encourage credit institutions to adopt flexible salary structures, but rather to require an applicant credit institution to pay due consideration when projecting its financial forecast to risks which may arise from recurring cost concentration, in order to set up appropriate mitigating measures should difficulty to meet the expected targets arise (due to stress situations and/or unpredicted losses or lost profits). However, it is noted that exclusive reference as an example to the comparison between discretionary pay costs and staff salaries might have unintended misleading effects.	Drafting amended.
Question 7. Are the elements for the determination of capital at authorisation and the determination of the amount to be paid up at the moment of the authorisation sufficiently clear?
Legal basis to request compliance with own funds requirements at authorisation	One respondent observed that the Guidelines require credit institutions to comply with own funds and other prudential requirements while the CRD only requires compliance with a minimum initial capital requirement (Article 12 CRD); in the respondent’s view the Guidelines exceed the CRD requirements. The respondent also noted that at the application stage it is impossible to have certain knowledge of the risk profile of the applicant credit institution’s prospective portfolio, which makes the	For the purposes of granting an authorisation, competent authorities have to assess whether the newly authorised credit institution will be able to meet the prudential requirements from the first day of access to the market as a credit institution. Hence, to be authorised, an applicant credit institution has to comply with prudential requirements, including own funds requirements.	No change.

Comments	Summary of responses received	EBA analysis Amendments to the proposals
	calculation of minimum capital requirements difficult.
	Question 8. The approach taken by these Guidelines as regards the CAM for the internal governance is to directly indicate the minimum main elements and aspects required for the assessment based on the requirements laid out in relevant EU regulatory acts. This selective approach, however, is without prejudice to the application by the competent authorities of additional parts of the various EBA Guidelines which may be relevant for the assessment of the applicant’s internal governance. Is this approach sufficiently clear?
General criteria applicable to the assessment of internal governance	A respondent suggested that paragraph 128 could be clarified to take into account matters regulated under legislation other than the CRD. Consideration should be given, for example, to relevant parts of MiFID II and associated ESMA Guidelines need to be referenced. A respondent also proposed that it should be made explicit that in certain circumstances a competent authority may need to carry out on-site visits, ask for demonstrations or conduct interviews with key staff in addition to reviewing documents before deciding whether to authorise an applicant credit institution.	With regard to MIFID activities, the designated authority under MIFID will be in charge of the relevant assessment of compliance with MiFID provisions. Providing guidance as regards matters covered by MiFID or other sectoral acts falling outside the EBA’s remit would exceed the EBA’s scope of competence. In accordance with the mandate set out in Article 8(5) CRD, the Guidelines should only cover the assessment methodology and not the process. At any rate, competent authorities will be liaising with the applicant and will assess the key staff in accordance with FAP guidelines.	No change.
Remuneration policy	A respondent proposed that where the applicant credit institution wishes to propose to offer investment services within the meaning of Annex 1 MiFID II to retail clients, the competent authority should also consider whether the remuneration policy in relation to those services is consistent with MiFID II.	Similarly to the comment above, this aspect is outside the EBA’s remit. It is noted, however, that the Guidelines refer to the Joint ESMA and EBA Guidelines on remuneration policies. In coordination with market authorities, competent authorities will review and assess the remuneration policy.	No change.

Comments	Summary of responses received	EBA analysis	Amendments to the proposals
Operational resilience and business continuity policy and plan	A respondent proposed that paragraph 182 of the draft Guidelines should be amended to reflect the fact that, in addition to reducing the risk of business disruption occurring and minimising losses, the operational resilience policy and plan should appropriately focus on recovery from business disruption events.	Paragraph 182 of the draft Guidelines is devoted to the operational resilience and business continuity policy and plan, underscoring that they must include an overview of the mitigation measures and ensure regular testing of the business continuity plan. Attention to such matters aims at ensuring appropriate recovery from business disruption events.	No change.
Legal basis to assess internal governance arrangement criteria at authorisation	One comment pointed out the lack of a legal basis to assess compliance with regulatory requirements at the authorisation stage and disagreed as to the inclusion of unspecified EBA Guidelines as part of the assessment.	An applicant credit institution may only be authorised if it is able to comply with prudential requirements as of the first day of access to the market. Emphasis on ‘the arrangements, processes and mechanisms referred to in Article 74(1) [CRD]’ is placed by Article 10 CRD on authorisation requirements. Paragraph 2 of these provisions also underscores that ‘competent authorities shall refuse authorisation to commence the activity of a credit institution unless they are satisfied that the arrangements, processes and mechanisms referred to in Article 74(1) enable sound and effective risk management by that institution’. In the light of the above, reference to the EBA Guidelines on internal governance and to other relevant elements of the Single Rulebook is therefore fully justified, including with a view to ensuring regulatory consistency between authorisation and ongoing supervision. Furthermore, it should be noted that the proportionality principle embedded in Article 74(2) of Directive 2013/36/EU aims to ensure that internal governance arrangements are consistent with the individual risk profile and business model of the	No change.
		institution so that the objectives of the regulatory requirements are effectively achieved.