Governance and fit and proper requirements

A banking licence is granted to an institution, but regulators decide largely on the people and structures behind it. A strong business plan with a weak board will not be approved. A licensed bank whose managers stop meeting the standard can have those managers removed.

This article explains the governance framework most regulators apply, using the EU rules as the most detailed published reference.

The management body

EU law uses the term “management body” to cover both a single board and a two-tier structure with a management board and a supervisory board. The management function runs the bank day to day. The supervisory function oversees and challenges management.

Minimum conditions start at authorisation. CRD Article 13 requires that “at least two persons effectively direct the business” of an applicant, often called the four-eyes principle. Authorisation must be refused if members of the management body do not meet the suitability requirements in Article 91.

CRD Article 91 sets those requirements. Members must be “of sufficiently good repute and possess sufficient knowledge, skills and experience to perform their duties”, commit sufficient time, and act with honesty, integrity and independence of mind. The body as a whole must have “adequate collective knowledge, skills and experience” to understand the institution’s activities and main risks.

Limits on directorships

Time commitment is not left entirely to judgement. For institutions that are significant in size, internal organisation and complexity, Article 91(3) limits members to one executive directorship with two non-executive directorships, or four non-executive directorships. Directorships within the same group count as one, and authorities may allow one additional non-executive role.

Board committees

Larger banks are expected to have risk, audit, remuneration and nomination committees, staffed by non-executive members with relevant expertise. Smaller banks may combine committees where national law allows. Supervisors read committee minutes to judge whether challenge is real or formal.

The three lines of defence

The EBA Guidelines on internal governance (EBA/GL/2021/05), which apply from 31 December 2021, are consistent with the three lines of defence model.

Line	Who	Role
First	Business lines, and support functions such as IT, HR and legal	Take risks and manage them directly, with processes and controls that keep activities within the risk appetite
Second	Independent risk management function and compliance function	Identify, measure, monitor and report risks across the institution; challenge the first line; monitor compliance with law and internal policy
Third	Internal audit	Independent, risk-based review of governance, processes and the first two lines

The guidelines state that all internal control functions need to be independent of the business they control, have adequate financial and human resources, and report directly to the management body. Institutions may add specific control functions, such as an AML compliance function or IT security control.

For a new bank, the practical test is staffing. A head of risk who also runs treasury, or a compliance officer who reports to the head of sales, will be challenged. Small banks can combine some roles, but supervisors expect clear independence for the heads of risk, compliance and internal audit.

Key function holders

Key function holders are people who are not on the management body but have significant influence over the direction of the institution. The heads of the internal control functions and the chief financial officer are the usual examples.

Directive (EU) 2024/1619 (CRD VI) adds a new Article 91a to the CRD. Institutions have primary responsibility for ensuring that key function holders are at all times of sufficiently good repute, act with honesty and integrity, and possess sufficient knowledge, skills and experience. They must assess them before appointment and periodically, and must not appoint, or must remove, a person who does not meet the standard.

For large institutions, competent authorities must themselves assess the heads of internal control functions and the CFO under Article 91a(5). CRD VI also requires a suitability application to reach the authority at least 30 working days before a new executive member or chair takes up the role in large institutions. Member States had to apply the general CRD VI measures from 11 January 2026.

Fit and proper assessments

The detailed EU method is set out in the joint ESMA and EBA Guidelines on the assessment of suitability (EBA/GL/2021/06), which ESMA and the EBA put out for consultation in revised form in 2026 to reflect CRD VI. For banks it directly supervises, the ECB publishes its own Guide to fit and proper assessments.

The ECB guide assesses members of the management body against five criteria from Article 91 of the CRD.

Criterion	What is assessed
Experience	Practical experience and theoretical knowledge relevant to the role
Reputation	Criminal and administrative records, personal and business conduct, and anything that raises material doubt about sound and prudent management
Conflicts of interest and independence of mind	Personal, professional, financial and political relationships; ability to challenge
Time commitment	Number and nature of other mandates, and the time the role actually requires
Collective suitability	Whether the board as a whole covers the bank’s activities and risks

Experience thresholds

The ECB guide uses thresholds that create a presumption of sufficient experience. Below them, the ECB looks more closely rather than refusing automatically.

Role	Threshold for presumption of sufficient experience
CEO	Ten years of recent practical experience in banking or financial services, including a significant proportion at senior managerial level
Executive director	Five years of recent practical experience in banking or financial services at senior managerial level
Non-executive chair	Ten years of recent relevant practical experience, with a significant proportion at senior level and significant theoretical knowledge in banking or a similar field
Non-executive director	Three years of recent relevant practical experience at high managerial level, including theoretical knowledge in banking

Interviews

The ECB treats interviews as part of its fact-finding. Under its guide, interviews are mandatory for new appointments of the CEO and the chair of the management body at stand-alone banks and at the top bank of a group. For other roles they are used on a proportionate, risk-based basis.

How an assessment runs in practice

1. The institution performs its own suitability assessment and documents it.
2. The candidate completes the regulator’s questionnaire, with CV, declarations and supporting evidence.
3. The regulator checks records with other authorities, including in other countries where the person has worked.
4. The regulator may interview the candidate and request more information.
5. The regulator approves, approves with conditions such as training, or refuses.
6. Suitability is reassessed when new facts arise, such as an investigation or a supervisory finding.

Article 91(1) of the CRD gives authorities the power to remove members who no longer meet the requirements. It singles out situations where there are reasonable grounds to suspect money laundering or terrorist financing.

Shareholders are assessed too

Owners of qualifying holdings are assessed for reputation, financial soundness and the legitimacy of their funds. Article 14 of the CRD requires an applicant to disclose the identities of shareholders with qualifying holdings, or the 20 largest shareholders where there are none. Regulators look through holding structures to the natural persons who control them.

Substance and mind and management

Substance means the licensed entity is directed and controlled where it is licensed, with real people making real decisions. It is the governance counterpart of the fit and proper test.

In the EU, CRD Article 13(2) requires a credit institution with a registered office to have its head office in the same Member State. The EBA outsourcing guidelines state that institutions “should maintain at all times sufficient substance and not become ‘empty shells’ or ‘letter-box entities’”. That includes meeting all conditions of authorisation and a management body that effectively carries out its responsibilities.

The same idea appears in the global AML standards. The FATF glossary defines the physical presence that distinguishes a real bank from a shell bank as “meaningful mind and management located within a country”, and states that a local agent or low-level staff alone is not enough.

Outside the EU, substance is often framed as a “mind and management” test. The Central Bank of Bahrain Rulebook makes mind and management a licensing condition: conventional banks with a registered office in Bahrain must keep their head office there, and branches of foreign banks must maintain local management presence and premises appropriate to their activities.

Signs that substance is missing

1. Board meetings held outside the licensing jurisdiction, with local directors who approve decisions taken elsewhere.
2. Senior managers who live abroad and visit occasionally.
3. Core functions, such as credit decisions or risk management, performed by a group company without a documented outsourcing arrangement and oversight.
4. A local office without staff able to answer supervisors’ questions.
5. Records, systems or data that the local entity cannot access without the parent’s permission.

Practical points for applicants

1. Recruit the core team before applying. Regulators assess named individuals, not job descriptions.
2. Match experience to the business model. A digital lending bank needs credit and technology risk expertise on the board, not only general banking experience.
3. Disclose fully. Omissions discovered later damage reputation more than the original issue.
4. Plan for time commitment. Non-executive candidates with many mandates may fail on time alone.
5. Document independence. Show how control functions are separate from business lines and how they reach the board.

The next article covers the compliance framework every bank must operate: anti-money laundering, know your customer and sanctions controls.