The authorisation procedures pertaining to the existence (licensing), shareholding (qualifying holding) and management (fit & proper) of credit institutions, and the legal requirements relating thereto, are set out in Articles 3 to 10-2 of the Law of 5 April 1993 on the financial sector (“LFS”). Circular CSSF 12/552 specifies the implementing procedures as regards central administration, internal governance and risk management. The prudential approval procedure for the appointment of key function holders sets out the fit & proper (“FAP”) approval process. Circular CSSF 17/669 details the prudential assessment criteria of qualifying shareholders.
Since November 2014, the European Central Bank (“ECB”) is exclusively competent for the licensing and qualifying holding approvals in all credit institutions (except third-country branches), and the FAP approvals in significant credit institutions, established in the Member States participating in the Single Supervisory Mechanism.
A banking authorisation may only be granted to a legal person incorporated under Luxembourg law. The legal person may only be incorporated as a public law institution, a société anonyme [public limited company], a société en commandite par actions [limited partnership with a share capital] or a société coopérative [cooperative society].
Central administration and infrastructure
The central administration must be established in Luxembourg and must have robust internal governance arrangements, effective risk management processes, adequate internal control mechanisms, sound administrative and accounting procedures, remuneration policies and practices allowing and promoting a sound and effective risk management as well as control and security arrangements for information processing systems. Moreover, the organisational requirements provided by MiFID must be met (Chapter 4, Part II of the LFS).
Authorisation is conditional on evidencing a subscribed and fully paid-up share capital of EUR 8,700,000.
The capital base of a credit institution may not be less than the amount of the prescribed authorised capital.
The authorised management must be composed of at least two members. The dirigeants (executive managers) must be empowered to effectively direct the business. They must produce evidence of their professional repute and must have already acquired an adequate level of professional experience through the performance of similar activities at a senior level in terms of responsibility and independence. Moreover, the prudential appointment procedure of key function holders in credit institutions must be complied with.
The shareholders, whether direct or indirect, natural or legal persons, that have or intend to acquire qualifying holdings in a bank (holding, directly or indirectly, 10% or more of the capital or of the voting rights or exercising a significant influence over the management of that undertaking) must be authorised. Authorisation is refused if the suitability of the shareholders is not likely to ensure a sound and prudent management of the bank’s business. A sound and prudent management is assessed on the basis of the following elements, laid down in Circular CSSF 17/669:
- the professional repute of the shareholders;
- the financial soundness of the shareholders;
- the bank’s ability to comply and continue to comply with prudential requirements and, in particular, the adequacy of the structure of the group to which the bank belongs in order to supervise effectively and to ensure a clear division of responsibilities between the competent authorities;
- the existence of suspected money laundering or terrorist financing.
Good repute, knowledge, competences and experience
Authorisation is conditional on the production by (i) the members of the bodies performing administrative, management and supervisory functions, (ii) the shareholders or partners and (iii) the key function holders, if already known, of evidence of their good repute and they must have the required knowledge, competences and experience to exercise their function. Such repute is assessed on the basis of police records and of any evidence tending to show that the persons concerned have a good reputation and offer every guarantee of irreproachable conduct.
Governance and remuneration policy
The governance and remuneration policy arrangements of Chapter 4a, Part II of the LFS, in particular the limits as regards multiple directorships, must be complied with.
Authorisation is conditional on the institution having its annual accounts audited by a réviseur d’entreprises agréé (approved statutory auditor) who provides proof of adequate professional experience.
Deposit guarantee and investor compensation schemes
Authorisation is subject to the credit institution’s membership in a deposit guarantee scheme and in an investor compensation scheme, established in Luxembourg and recognised by the CSSF.
Since November 2014, the ECB is exclusively competent to authorise all credit institutions established in the Member States participating in the Single Supervisory Mechanism. This competence is exercised in close cooperation with the national competent authorities.
As far as the authorisation of third-country branches is concerned, the competence for granting a banking authorisation remains with the Minister in charge of the CSSF.
The maximum processing time for a banking authorisation file is 12 months. An application file which is considered complete may be dealt with within 6 months. The 12-month period begins as from the date of submission of the (complete or incomplete) application file.
To avoid the automatic rejection of the application file because the deadline is exceeded, the CSSF recommends that the applicants conduct preliminary discussions with the department in charge of the supervision of banks prior to the formal submission of the application file.
Formal submission of the application file
The banking authorisation file (formal submission) must be addressed to the CSSF in hard copy and in electronic format. For banks authorised by the ECB, the application file should preferably be drafted in English.
Except for third-country branches, the CSSF notifies the reception of the application file to the ECB. The application for authorisation will be assessed by the CSSF and the ECB, verifying that the applicant complies with all the authorisation requirements. If the CSSF considers that the application file meets all the requirements, it provides a draft proposal to the ECB to grant the banking authorisation to the applicant. The Supervisory Board of the ECB submits the draft proposal to the Governing Council of the ECB for adoption. The authorisation is granted by the ECB and notified by the CSSF.
If the CSSF considers that the file does not fulfil all the requirements, the CSSF informs the applicant of its decision to reject the application, indicating the possible remedies thereof.
For third-country branches, the applicant submits its banking authorisation file to the CSSF for assessment. Upon validation of the banking authorisation file by the CSSF, the applicant transmits the application file to the Minister responsible for the CSSF for authorisation. The banking authorisation is granted directly by the Minister responsible for the CSSF, upon consultation with the CSSF.
Information to be provided
There is no standard form, but the application for authorisation must be accompanied by all such information as may be needed for the assessment thereof and by a programme of operations indicating the type and volume of business envisaged and the administrative and accounting structure of the institution in question.
A non-exhaustive list is provided hereafter for general guidance purposes only.
1. Key information
- Presentation of the group, including complete structure chart
- Presentation of the bank project (including reasons for setting up a bank and establishing in Luxembourg)
2. Description of the business model
- Detailed description of proposed activities and offered services
- Description of targeted clients and strategy to achieve targeted levels
- Description of geographical distribution and envisaged branches/subsidiaries
- Description of key elements of business plan (see detailed business plan annex below)
- Description of organisational structure including human resources
- Description of IT infrastructure and organisation (see detailed IT requirements annex below)
- Description of outsourcing arrangements (for IT outsourcing see detailed IT requirements annex below)
- Description of business continuity plan including backup facilities & disaster recovery (see detailed IT requirements annex below)
3. Capital and liquidity
- Own funds (amount, sources and composition)
- Capital buffers
- Description of ICAAP/ILAAP procedures that will be implemented by the bank (description of the risks covered, the bodies responsible within the institution, etc.)
4. Central administration/ internal governance
- Organogram of the future bank (comprising board of directors, authorised management, board committees, operational committees, key functions, business and administrative departments etc.) including hierarchical and functional reporting lines
- Description of internal governance including key processes and conflict of interest policy
- Information on internal control functions (organisation, heads of function, reporting lines) (see also detailed suitability annex below)
- Presentation of board members, authorised managers and key function holders (see also detailed suitability annex below)
- Description of shareholders (identity, details of shareholder rights, shareholder agreements) (see also detailed shareholder annex below)
- Information and documentation on the shareholders’ source of wealth (economical & geographical) and the origin of the funds that will be used for the banking project, including means of transfer
- Applicant’s ML/FT risk analysis of the activities envisaged in its business plan, covering at a minimum clients and geographic reach, products and services, use of intermediaries and distribution channels
Further detail is provided under “Documentation – Guidance” in Authorisation procedure – List of annexes to be provided with the banking license application file.
Since November 2014, the ECB is exclusively competent to authorise all qualifying holdings in credit institutions established in the Member States participating in the Single Supervisory Mechanism. It is to be noted that the present procedure covers participations taken by acquirers in Luxembourg credit institutions (the “Target”), as opposed to participations taken by Luxembourg credit institutions under Article 57 of the LFS.
The formal notification file shall be adressed to the CSSF in both hard copy and in electronic format. The CSSF will share the notification with the ECB.
Acknowledgement of Receipt
Upon receipt of the formal notification, the CSSF acknowledges receipt of the notification and informs the acquirer whether the notification is complete in accordance with Article 6(7) of the LFS. In case the information is not complete, a list of missing information will be sent to the acquirer, in order to complete the notification.
The notification will be assessed within 60 working days by the CSSF and the ECB. The assessment period starts from the working day following the day of the aknowledgement of completeness of the notification.
The assessment period is calculated in accordance with the ECB’s calendar and the end of assessment period will be stated in the aknowledgement of completeness of the notification.
During the assessment period, the CSSF as well as the ECB, may request further information as deemed necessary in order to complete the assessment. Any such request, which shall be made no later than the fiftieth working day of the assessment period will suspend the assessment period until the requested information is provided, subject to the maximum suspension period prescribed by Article 6(8) of the LFS.
The ECB is exclusively competent to decide whether to oppose or not to oppose the proposed acquisitions of qualifying holdings. The CSSF will provide a proposed decision to the ECB based on its analysis of the assessment criteria. The authorisation decision is issued and notified by the ECB.
Information to be provided
Information requirements for qualifying holding notifications can vary depending on the nature of each application file, such as the type of acquirer, percentage of holdings or voting rights acquired and the impact on the Target.
The non-exhaustive list provided below is intended for general guidance purposes only and shall be read in conjunction with the relevant legal requirements and Circular CSSF 17/669. In case of change in the management bodies of the Target, section 3 of the list below shall be relevant and it shall be read in conjunction with CSSF’s prudential procedure for the appointment of key function holders in credit institutions.
1. General information
a) Signed notification from all acquirers (and relevant powers of attorney if applicable),
b) Identification and description of the acquirers, including information on acting in concert and/or significant influence (if applicable),
c) Description of the proposed acquisition, including background, motivation, key terms of the transaction (including purchase price),
d) Complete shareholding structure of the Target before and after the acquisition (Indicating the percentages of capital and voting rights (if different) for each direct and indirect holder),
e) Share Purchase Agreement or equivalent.
2. Reputation of the proposed acquirer (Article 6 (9) (a) LFS)
I. Natural persons
a) Copy of passport(s) or ID card(s),
b) Criminal records extract(s),
c) Declaration of honour for natural persons (please check for latest version using the following link and complete with due care before signing: http://www.cssf.lu/en/supervision/banks/forms/),
d) Comprehensive and detailed CV,
e) Signed ECB qualifying holding privacy statement.
II. Legal persons
a) Declaration of honour for legal persons (please check for latest version using the following link and complete with care before signing: http://www.cssf.lu/en/supervision/banks/forms/),
b) Certificate of registration,
c) Statutes / articles of incorporation,
d) Ratings (if available),
e) Criminal records extract (if available),
f) If a regulated entity, certificate of good standing from the relevant supervisory authority,
g) Reputation documents for persons who effectively direct the business, see section 2.I. above,
h) Detailed organisational chart of the entire corporate structure,
i) Names of regulated entities within the group with type of regulated activity and names of the relevant supervisory authorities,
j) Signed ECB qualifying holding privacy statement.
3. Reputation and professional experience of those who will direct the business of the Target as a result of the acquisition (Article 6 (9) (b) LFS)
a) Copy of passport(s) or ID card(s),
b) Criminal records extract(s),
c) Declaration of honour for natural persons (please check for latest version and complete with due care before signing),
d) Comprehensive and detailed CV,
e) Only for board members and authorised managers of significant institutions: Fit and Proper declaration for natural persons (please check for latest version and complete with care before signing),
f) (Individual and collective) suitability assessment of the Board of Directors or authorised management,
g) Signed ECB fit and proper privacy statement.
4. Financial soundness of the proposed acquirer (Article 6 (9) (c) LFS)
a) Audited financial statements for the last 3 years,
b) Summary of key ratios,
c) An up-to-date overview of entrepreneurial activities: activities, products, countries of operations etc.,
d) Sources of funding of the proposed acquisition (including all relevant supporting documents),
e) Strategy and level of intended influence on Target,
f) Intended holding period and any foreseen increase/decrease of shareholdings,
g) Business plan of the acquirer, where relevant, see details on section 5.d) below.
5. Compliance with the prudential requirements of the Target after the acquisition (Article 6 (9) (d) LFS)
a) Perimeter of consolidated supervision of the Target and the group that it would belong to after the proposed acquisition,
b) Whether the acquisition will impact in any way, on (i) the ability of the Target to continue to provide timely and accurate information to the CSSF and (ii) the corporate governance and general organisational structure,
c) Willingness of the acquirer to support the Target with additional own funds if needed for the development of its activities or in case of financial difficulties,
d) Business plan, at the Target and at acquirer’s group levels, where relevant,
- Strategic development plan,
- 3- year business plan including:
- Balance sheet, income statement, regulatory requirements covering at least 3 years of forecasts (in electronic format) and including core ratios (capital ratio, LCR, NSFR, leverage ratio, RWAs, level of own funds),
- Business plan shall include all relevant business drivers, assumptions (e.g. number of clients, interest rates by product type, fee structure, evolution of number of employees and assumptions on costs etc.) and intragroup exposures,
- Elaboration of an adverse scenario including lower growth perspectives, longer implementation phase and deteriorated economic circumstances (balance sheet, income statement, regulatory requirements and assumptions).
6. Suspicion of money laundering or terrorist financing (Article 6 (9) (e) LFS)
a) Information & documentation on the acquirer’s source of wealth (economical & geographical) and the origin of the funds that will be used for the acquisition, including means of transfer.
b) Summarised description of the acquirer’s anti-money laundering and terrorist financing framework.
c) Acquirer’s ML/FT risk analysis of the activities envisaged in its business plan; this analysis should cover at a minimum the following risk factor categories: Clients & geographic reach, products and services, use of intermediaries & distribution channels.
d) Acquirer’s assessment of the acquisition’s impact on the Target’s anti-money laundering and terrorist financing framework (e.g. internal/AML governance, AML risk appetite statement, adequacy of systems and resources, etc.).
e) Does the proposed, post-acquisition business model, increase the Target’s inherent money-laundering and terrorist financing risk? If so, describe the mitigating measures in terms of controls, procedures, training, staffing, etc.
Since November 2014, the ECB is exclusively competent for taking decisions on the appointment of all members of the management bodies of significant credit institutions which fall under its direct supervision.
In the case of a less significant credit institution already authorised, the CSSF is exclusively competent to decide on the appointment of all the members of the management body.
The CSSF is the single point of contact for the introduction of all files. The files must include all the information and all the documents requested in the prudential procedure for the appointment of key function holders in credit institutions.
In accordance with the generally applicable deadlines for administrative decisions in Luxembourg, FAP approval decisions shall be communicated to the institution within three months of receipt of the complete application. If during the assessment period, additional information and/or missing documents are requested by the CSSF/ECB, the three months deadline will only start to run once such additional information has been provided.
As regards appointments in significant credit institutions, please note that, from January 2021, the submission of FAP applications will need to be exclusively done via a portal dedicated to authorisations set up by the ECB, the “IMAS Portal”, which can be accessed via the following link: Link to IMAS Portal
The dedicated IMAS Portal of the ECB should exclusively be used for new FAP applications regarding members of the management body, both in their management function (executives) and supervisory function (non-executives) of significant credit institutions.
In the following cases, the IMAS Portal should not be used:
- Notification of Key Function Holders (who are not expected to also become members of the management body)
- Notification of renewals (without any change in the executive or non-executive nature of the mandate)
- Communication of new material facts regarding appointees previously assessed and approved.
The use of the portal does not change the legal environment according to which the ECB and CSSF cooperate for their interaction with supervised institutions and does not change in any way the allocation of legal responsibilities between the CSSF and the ECB.
The ECB is exclusively competent to decide whether to oppose or not to oppose relevant FAP appointments in significant institutions. The CSSF assists the ECB in the assessment of the suitability of the appointee by drawing up a preliminary proposal, based on its analysis of the different fit and proper criteria. The authorisation decision is issued and notified by the ECB.