Legal requirements and authorisation procedures for credit institutions

The authorisation procedures pertaining to the existence (licensing), shareholding (qualifying holding) and management (fit & proper) of credit institutions, and the legal requirements relating thereto, are set out in Articles 3 to 10-2 of the Law of 5 April 1993 on the financial sector (“LFS”). Circular CSSF 12/552 specifies the implementing procedures as regards central administration, internal governance and risk management. The prudential approval procedure for the appointment of key function holders sets out the fit & proper (“FAP”) approval process. Circular CSSF 17/669 details the prudential assessment criteria of qualifying shareholders.

Since November 2014, the European Central Bank (“ECB”) is exclusively competent for the licensing and qualifying holding approvals in all credit institutions (except third-country branches), and the FAP approvals in significant credit institutions, established in the Member States participating in the Single Supervisory Mechanism.

A banking authorisation may only be granted to a legal person incorporated under Luxembourg law. The legal person may only be incorporated as a public law institution, a société anonyme [public limited company], a société en commandite par actions [limited partnership with a share capital] or a société coopérative [cooperative society].

The central administration must be established in Luxembourg and must have robust internal governance arrangements, effective risk management processes, adequate internal control mechanisms, sound administrative and accounting procedures, remuneration policies and practices allowing and promoting a sound and effective risk management as well as control and security arrangements for information processing systems. Moreover, the organisational requirements provided by MiFID must be met (Chapter 4, Part II of the LFS).

Authorisation is conditional on evidencing a subscribed and fully paid-up share capital of EUR 8,700,000.

The capital base of a credit institution may not be less than the amount of the prescribed authorised capital.

The authorised management must be composed of at least two members. The dirigeants (executive managers) must be empowered to effectively direct the business. They must produce evidence of their professional repute and must have already acquired an adequate level of professional experience through the performance of similar activities at a senior level in terms of responsibility and independence. Moreover, the prudential procedure for the appointment of members of the management body and key function holders in credit institutions must be complied with.

The shareholders, whether direct or indirect, natural or legal persons, that have or intend to acquire qualifying holdings in a bank (holding, directly or indirectly, 10% or more of the capital or of the voting rights or exercising a significant influence over the management of that undertaking) must be authorised. Authorisation is refused if the suitability of the shareholders is not likely to ensure a sound and prudent management of the bank’s business. A sound and prudent management is assessed on the basis of the following elements, laid down in Circular CSSF 17/669:

• the professional repute of the shareholders;
• the financial soundness of the shareholders;
• the bank’s ability to comply and continue to comply with prudential requirements and, in particular, the adequacy of the structure of the group to which the bank belongs in order to supervise effectively and to ensure a clear division of responsibilities between the competent authorities;
• the existence of suspected money laundering or terrorist financing.

Authorisation is conditional on the production by (i) the members of the bodies performing administrative, management and supervisory functions, (ii) the shareholders or partners and (iii) the key function holders, if already known, of evidence of their good repute and they must have the required knowledge, competences and experience to exercise their function. Such repute is assessed on the basis of police records and of any evidence tending to show that the persons concerned have a good reputation and offer every guarantee of irreproachable conduct.

The governance and remuneration policy arrangements of Chapter 4a, Part II of the LFS, in particular the limits as regards multiple directorships, must be complied with.

Authorisation is conditional on the institution having its annual accounts audited by a réviseur d’entreprises agréé (approved statutory auditor) who provides proof of adequate professional experience.

Authorisation is subject to the credit institution’s membership in a deposit guarantee scheme and in an investor compensation scheme, established in Luxembourg and recognised by the CSSF.

Since November 2014, the ECB is exclusively competent to authorise all credit institutions established in the Member States participating in the Single Supervisory Mechanism. This competence is exercised in close cooperation with the CSSF.

As far as the authorisation of third-country branches is concerned, the competence for granting a banking authorisation remains with the Minister in charge of the CSSF.

The maximum processing time for a banking authorisation file is 12 months. An application file which is considered complete may be dealt with within 6 months. The 12-month period begins as from the date of submission of the (complete or incomplete) application file.

To avoid the automatic rejection of the application file because the deadline is exceeded, the CSSF recommends that the applicants conduct preliminary discussions with the department in charge of the supervision of banks prior to the formal submission of the application file.

The banking authorisation file (formal submission) must be addressed to the CSSF in hard copy and in electronic format. For banks authorised by the ECB, the application file should preferably be drafted in English.

Except for third-country branches, the CSSF notifies the reception of the application file to the ECB. The application for authorisation will be assessed by the CSSF and the ECB, verifying that the applicant complies with all the authorisation requirements. If the CSSF considers that the application file meets all the requirements, it provides a draft proposal to the ECB to grant the banking authorisation to the applicant. The Supervisory Board of the ECB submits the draft proposal to the Governing Council of the ECB for adoption. The authorisation is granted by the ECB and notified by the CSSF to the applicant.

If the CSSF considers that the file does not fulfil all the requirements, the CSSF informs the applicant of its decision to reject the application, indicating the possible remedies thereof.

For third-country branches, the applicant submits its banking authorisation file to the CSSF for assessment. Upon validation of the banking authorisation file by the CSSF, the applicant transmits the application file to the Minister responsible for the CSSF for authorisation. The banking authorisation is granted directly by the Minister, upon consultation with the CSSF.

There is no standard form, but the application for authorisation must be accompanied by all such information as may be needed for the assessment thereof and by a programme of operations indicating the type and volume of business envisaged and the administrative and accounting structure of the institution in question.

A non-exhaustive list is provided hereafter for general guidance purposes only.

1. Key information

• Presentation of the group, including complete structure chart
• Presentation of the bank project (including reasons for setting up a bank and establishing in Luxembourg)

2. Description of the business model

• Detailed description of proposed activities and offered services
• Description of targeted clients and strategy to achieve targeted levels
• Description of geographical distribution and envisaged branches/subsidiaries
• Detailed description of the business plan (see detailed business plan annex below)
• Description of organisational structure including human resources
• Description of IT infrastructure and organisation (see detailed IT requirements annex below)
• Description of outsourcing arrangements (for IT outsourcing see detailed IT requirements annex below)
• Description of business continuity plan including backup facilities & disaster recovery (see detailed IT requirements annex below)

3. Capital and liquidity

• Own funds (amount, sources and composition)
• Description of ICAAP/ILAAP procedures that will be implemented by the bank (description of the risks covered, the bodies responsible within the institution, etc.)

4. Central administration/ internal governance

• Organogram of the future bank (comprising board of directors, authorised management, board committees, operational committees, key functions, business and administrative departments etc.) including hierarchical and functional reporting lines
• Description of internal governance including key processes and conflict of interest policy
• Information on internal control functions (organisation, heads of function, reporting lines) (see also detailed suitability annex below)
• Presentation of board members, authorised managers and key function holders (see also detailed suitability annex below)
• Description of shareholders (identity, details of shareholder rights, shareholder agreements) (see also detailed shareholder annex below)

5. AML/TF

• Information and documentation on the shareholders’ source of wealth (economical & geographical) and the origin of the funds that will be used for the banking project, including means of transfer
• Applicant’s ML/FT risk analysis of the activities envisaged in its business plan, covering at a minimum clients and geographic reach, products and services, use of intermediaries and distribution channels

Further detail is provided under “Documentation – Guidance” in Authorisation procedure – List of annexes to be provided with the banking license application file.

Since November 2014, the ECB is exclusively competent to authorise all qualifying holdings in credit institutions established in the Member States participating in the Single Supervisory Mechanism. It is to be noted that the present procedure covers participations taken by acquirers in Luxembourg credit institutions (the “Target”), as opposed to participations taken by Luxembourg credit institutions under Article 57 of the LFS.

From 27 September 2021, the notification file shall be submitted via a portal dedicated to authorisations set up by the ECB, the “IMAS Portal”. This portal can be accessed via the following link: IMAS portal (europa.eu).The use of the IMAS Portal does not change the legal environment according to which the ECB and the CSSF cooperate for their interaction with supervised institutions and does not change in any way the allocation of legal responsibilities between the CSSF and the ECB.

Upon receipt of the formal notification, the CSSF acknowledges receipt of the notification and informs the acquirer whether the notification is complete in accordance with Article 6(7) of the LFS. In case the information is not complete, a list of missing information will be sent to the acquirer, in order to complete the notification.

The notification will be assessed within 60 working days by the CSSF and the ECB. The assessment period starts from the working day following the day of the acknowledgement of completeness of the notification.

The assessment period is calculated in accordance with the ECB’s calendar and the end of assessment period will be stated in the acknowledgement of completeness of the notification.

During the assessment period, the CSSF as well as the ECB, may request further information as deemed necessary in order to complete the assessment. Any such request, which shall be made no later than the fiftieth working day of the assessment period will suspend the assessment period until the requested information is provided, subject to the maximum suspension period prescribed by Article 6(8) of the LFS. Note that a concomitant financial holding company approval or exemption procedure can lead to a further suspension in accordance with Article 6(5a) of the LFS.

The ECB is exclusively competent to decide whether to oppose or not to oppose the proposed acquisitions of qualifying holdings. The CSSF will provide a proposed decision to the ECB based on its analysis of the assessment criteria. The authorisation decision is issued and notified by the ECB.

Information requirements for qualifying holding notifications can vary depending on the nature of each application file, such as the type of acquirer, percentage of holdings or voting rights acquired and the impact on the Target.

The core form in IMAS Portal shall be completed in accordance with the relevant legal requirements and Circular CSSF 17/669. In case of change in the management bodies of the Target, the core form shall be completed in accordance with the CSSF’s prudential procedure for the appointment of members of the management body and key function holders in credit institutions.

Prior to the official submission of the notification, we recommend the proposed acquirers to engage in pre-notification discussions with the CSSF, in order to clarify expected information requirements, timeline and coordination for other potentially related procedures.

Since November 2014, the ECB is exclusively competent for taking decisions on the appointment of all members of the management bodies of significant credit institutions which fall under its direct supervision.

In the case of a less significant credit institution already authorised, the CSSF is exclusively competent to decide on the appointment of all the members of the management body.

The CSSF is the single point of contact for the introduction of all files. The files must include all the information and all the documents requested in the prudential procedure for the appointment of members of the management body and key function holders in credit institutions.

In accordance with the generally applicable deadlines for administrative decisions in Luxembourg, FAP approval decisions shall be communicated to the institution within three months of receipt of the complete application. If during the assessment period, additional information and/or missing documents are requested by the CSSF/ECB, the three months deadline will only start to run once such additional information has been provided.

As regards appointments in significant credit institutions, please note that, from January 2021, the submission of FAP applications will need to be exclusively done via a portal dedicated to authorisations set up by the ECB, the “IMAS Portal”, which can be accessed via the following link: Link to IMAS Portal

The dedicated IMAS Portal of the ECB should exclusively be used for new FAP applications regarding members of the management body, both in their management function (executives) and supervisory function (non-executives) of significant credit institutions.

In the following cases, the IMAS Portal should not be used:

• Notification of Key Function Holders (who are not expected to also become members of the management body)
• Notification of renewals (without any change in the executive or non-executive nature of the mandate)
• Communication of new material facts regarding appointees previously assessed and approved.

The use of the portal does not change the legal environment according to which the ECB and CSSF cooperate for their interaction with supervised institutions and does not change in any way the allocation of legal responsibilities between the CSSF and the ECB.

The ECB is exclusively competent to decide whether to oppose or not to oppose relevant FAP appointments in significant institutions. The CSSF assists the ECB in the assessment of the suitability of the appointee by drawing up a preliminary proposal, based on its analysis of the different fit and proper criteria. The authorisation decision is issued and notified by the ECB.