How to license a bank: from business plan to authorisation

A banking licence is the most demanding authorisation in financial services. The applicant asks the state for permission to take deposits from the public, which is why supervisors examine the whole institution before it opens: its owners, its managers, its money, its systems and its controls.

This guide follows the path most applicants take, from the first business plan to the first customer. It uses the published approaches of the European Central Bank (ECB) under the Single Supervisory Mechanism, the UK Prudential Regulation Authority (PRA), the Swiss Financial Market Supervisory Authority (FINMA), the Monetary Authority of Singapore (MAS) and the Hong Kong Monetary Authority (HKMA).

Who grants the licence

The answer depends on where the bank will be incorporated, and it matters for how you plan the project.

Jurisdiction	Licensing authority	Entry point for the application
Euro area	ECB (for all credit institutions)	National competent authority (NCA)
United Kingdom	PRA (banks are dual-regulated with the FCA)	PRA New Bank Start-up Unit
Switzerland	FINMA	FINMA survey and application platform
Singapore	MAS	MAS
Hong Kong	HKMA	HKMA

In the euro area, the ECB is the authority in charge of banking authorisations, but national supervisors are the entry point for most applications and work with the ECB on the assessment. The NCA prepares a draft decision, and the ECB takes the final one. Outside the euro area, EU Member States license banks through their own NCA under the same Capital Requirements Directive (CRD).

Step 1: Choose the right licence

Before drafting anything, confirm that a full bank licence is what the business needs. Many projects that start as “a bank” are better served by an e-money, payment or investment firm licence, which carry lower capital and fewer prudential obligations but do not allow deposit-taking.

Some jurisdictions offer intermediate categories. Switzerland has a FinTech licence for firms that accept public deposits of up to CHF 100 million without investing them or paying interest on them. Hong Kong runs a three-tier system of licensed banks, restricted licence banks and deposit-taking companies, each with its own minimum capital. Singapore separates full banks, wholesale banks and digital banks.

The ECB lists identifying “whether a credit institution licence is the appropriate authorisation for the entity” as one of the purposes of its pre-application discussions, according to its Guide to assessments of licence applications.

Step 2: Pre-application engagement

All five regulators in this guide encourage contact before a formal filing. It is optional in law, but in practice applications that skip it rarely run smoothly.

• ECB and euro area NCAs. The ECB guide describes a pre-application phase used to explain the process and information requirements, review the licensing plans and raise early prudential concerns. It says the practice “is greatly encouraged” and that pre-application discussions have no impact on the legal timeline.
• UK. The PRA’s New Bank Start-up Unit runs a structured pre-application process in three stages: a business proposition meeting, a review of a draft regulatory business plan, and technical sessions on the final business plan, ICAAP and ILAAP. Each stage typically has a meeting within three to six weeks of submission and written feedback afterwards.
• Switzerland. FINMA asks that the licensing project is presented before a formal application is filed.

Senior decision-makers should attend these meetings. The ECB guide notes that the right participants are “senior staff with the capacity to take decisions as well as persons with sufficient operational knowledge to respond to detailed questions.”

Step 3: Build the application pack

The content of the application is broadly similar across jurisdictions. In the EU, the EBA Guidelines on the authorisation of credit institutions (EBA/GL/2021/12) set a common assessment methodology covering the programme of operations, capital, shareholders, the management body, internal governance, ICT, outsourcing and money laundering risk.

A typical pack contains:

1. Programme of operations and business plan: strategy, target customers and markets, products, distribution channels, and financial forecasts in a base case and a severe but plausible stress case.
2. Capital plan: initial capital, projected own funds requirements, start-up losses and the source of the capital.
3. Shareholder information: the full ownership chain to the ultimate beneficial owners, with financial statements and source of funds for each qualifying shareholder.
4. Management body: CVs, fit and proper questionnaires and evidence of time commitment for every board member and key function holder.
5. Governance and risk framework: organisational chart, committees, three lines of defence, risk appetite, internal capital and liquidity assessments (ICAAP and ILAAP).
6. IT and outsourcing: architecture, security, business continuity, and every material outsourcing contract.
7. AML/CFT framework: business-wide risk assessment, policies, customer due diligence procedures and the appointed AML officer.
8. Recovery and exit planning: how the bank would restore its position under stress, and, where asked, how it would wind down in an orderly way.

The EBA guidelines also tell supervisors to ask whether an applicant that plans to do most of its business elsewhere chose its jurisdiction “for the purpose of avoiding stricter regulatory standards (e.g. in respect of the AML/CFT regime)”. Substance in the licensing state is expected, not optional.

Step 4: Capital

The legal floor in the EU is set by Article 12 of the CRD: authorisation must be refused where initial capital is less than EUR 5 million. Member States may allow particular categories of credit institution to start with no less than EUR 1 million, after notifying the Commission and the EBA.

The legal minimum is rarely the answer. Under the EBA methodology, supervisors estimate own funds requirements over at least three years in both base and stress scenarios, compare that with initial capital plus expected cumulative losses for the first three years, and take the higher figure. The ECB applies the same logic, and its fintech licensing guide asks applicants to show they can “hold in reserve sufficient capital to cover start-up losses in the first three years of activity”.

Other regulators publish fixed minimums:

Jurisdiction	Published minimum for a full bank	Source
EU	EUR 5 million initial capital (EUR 1 million for permitted categories)	CRD Article 12
Switzerland	CHF 10 million fully paid-up	FINMA
Hong Kong	HK$300 million (licensed bank); HK$100 million (restricted licence bank); HK$25 million (deposit-taking company)	HKMA
Singapore	S$1.5 billion paid-up for a full digital bank; S$15 million at entry as a restricted digital full bank	MAS

Capital must be paid up, unencumbered and from a source the supervisor can verify. Borrowed money presented as equity, or funds that cannot be traced, are among the most common reasons applications stall.

Step 5: Fit and proper assessment

Supervisors assess two groups of people: those who run the bank and those who own it.

Management. The CRD requires that at least two persons effectively direct the business. The ECB assesses board members on experience, reputation, conflicts of interest, collective suitability and time commitment, as set out in its Guide on qualifying holding procedures. FINMA requires separation between strategic oversight and executive management, an independent internal audit, and management directed from Switzerland. The HKMA states that the chief executive, directors, controllers and executive officers must be “fit and proper”.

Shareholders. Anyone holding a qualifying holding (10% or more of capital or voting rights, or significant influence) is assessed for reputation, financial soundness and links to money laundering risk. The HKMA’s Guideline on Minimum Criteria for Authorization states that a person intending to hold 50% or more of a locally incorporated authorised institution should generally be “a well established bank or other supervised financial institution in good standing”. FINMA requires that foreign-controlled banks show reciprocal rights in the countries where qualified participants are domiciled.

The same shareholder rules apply later when someone wants to buy the bank. Our guide on change of control covers that process.

Step 6: IT, outsourcing and operational resilience

Technology is assessed as part of the licence. For EU banks, the Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025 and sets binding requirements on ICT risk management, incident reporting, testing and third-party risk.

The ECB’s fintech guide sets out what supervisors check on outsourcing: whether contracts allow the bank and its supervisors to audit outsourced activities, how cloud arrangements are managed, and whether the bank can detect and respond to cyber incidents. A bank built on a core banking platform rented from a vendor must still show that it controls and understands that platform.

Practical points for the application:

• Map every critical function and state who performs it, where, and under what contract.
• Show that exit from each critical vendor is possible without stopping the bank.
• Present test results, not only designs. The EBA guidelines allow supervisors to require ICT system tests before the licence becomes effective.

Step 7: AML and financial crime framework

Supervisors examine money laundering and terrorist financing risk at authorisation, not only after launch. The EBA guidelines treat ML/TF risk as part of every assessment area, from the business model and target markets to the suitability of shareholders and managers.

An application should include a business-wide risk assessment tied to the actual product set and customer base, a named AML compliance officer with the authority and resources to act, customer due diligence and transaction monitoring procedures, sanctions screening, and a training plan. Where the business plan targets higher-risk customers, geographies or channels, the framework must show proportionately stronger controls.

For banks that will need foreign currency clearing, especially in US dollars, correspondent banks will run their own due diligence on the new bank. A weak AML framework can leave a licensed bank without the correspondent relationships it needs to operate.

Step 8: Conditional licences and mobilisation

Few new banks are ready to serve customers on the day they are licensed. Regulators have developed ways to grant authorisation while the build is completed.

• UK mobilisation. The PRA offers authorisation with restrictions, during which “the bank’s deposit-taking permission is restricted to a total of £50,000” while it completes its operational build. This period typically lasts no longer than 12 months.
• EU conditions and restrictions. The EBA guidelines allow supervisors to attach conditions precedent, obligations and restrictions to a licence, for example limiting deposits per depositor. Lifting the restrictions is subject to a further assessment.
• Singapore restricted digital bank. A new digital full bank in Singapore starts as a Restricted DFB with S$15 million paid-up capital, aggregate deposits capped at S$50 million and individual deposits capped at S$75,000, then graduates by building capital toward S$1.5 billion.

A licence that is granted but not used does not last forever. Under CRD Article 18, authorisation may be withdrawn if the bank does not make use of it within 12 months.

Step 9: Timelines

Statutory deadlines set the outer limit, but the real timeline depends on preparation and responsiveness.

Jurisdiction	Statutory or published timeline
EU (CRD Article 15)	Decision within six months of a complete application, and in any event within 12 months of receipt
UK (PRA)	Target of four months for a complete application (statutory six); ten months for an incomplete one (statutory 12)
Switzerland	No fixed period; depends on licence type, quality and complexity of the application

The ECB notes that Member States start the clock differently: some at receipt even if incomplete, others only when complete. Its guide states that the entire process “should not exceed 12 months, including any suspension periods.” Pre-application work and post-licence mobilisation are not included in these figures, so the full journey from first meeting to first customer is normally longer.

The UK application fee, covering both PRA and FCA, is £56,300 according to the PRA’s New Bank Start-up Unit page at the time of writing.

What is changing

The ECB announced in June 2026 that its Guide to licence applications is being revised to clarify procedural matters and refer expressly to the EBA guidelines, with publication expected in the third quarter of 2026. Applicants in the euro area should check for the revised guide before filing.

The amended CRD (Directive (EU) 2024/1619) also requires many third-country banks to establish an authorised branch to provide core banking services in a Member State, with most of those rules applying from 11 January 2027. Groups planning to serve EU clients from outside the Union should factor this into the choice between a subsidiary and a branch.

Common reasons applications fail

• A business plan that does not survive stress testing, or projects profits without a credible path to them.
• Capital from sources the supervisor cannot verify, or dependent on a single shareholder with limited means.
• Management without banking experience in the proposed business lines.
• Outsourcing that leaves the bank without real control over its core systems.
• An AML framework copied from a template rather than built for the actual customers.
• Little or no substance in the licensing jurisdiction.

None of these issues is fatal if raised early. That is the main value of the pre-application phase: it lets the applicant fix weaknesses before they are recorded in a formal assessment.