🇪🇺Licensee Substance: People, Office and Functions

Concept

A financial licence is granted to a specific company in a specific country, and the regulator expects that company to exist there in fact. Decisions are taken by people the regulator has approved and can call in; control functions operate inside the company or under its genuine control; the office is the place from which the company is run. This set of requirements about people, place and functions is what is meant by a licensee's regulatory substance.

The requirement follows from the logic of supervision. A regulator answers for the company it has authorised and, in the EU, for everything that company does in other Member States under its passport. If management sits in a third country while the group performs compliance and operations, supervision has nothing to reach: there is no one to hold to account and nothing to inspect. EU, UK, Hong Kong and Singapore law therefore express substance through the same three questions: where the head office is, who effectively directs the business and who is responsible for the key functions.

Substance has three elements, and each is tested separately.

None of these elements is a number that can be met on paper. The regulator assesses the whole picture: how many people, with what authority, where they work and what remains in-house after outsourcing. The rules behind that assessment:

The table shows the common pattern; regimes differ in the detail, some naming resident individuals and others speaking only of where decisions are taken.

How substance is tested: from application to withdrawal

Application

Testing starts with the business plan and the organisation chart. The applicant shows who sits on the management body, who is responsible for compliance, risk and AML/CFT, where these people work and which functions are outsourced to the group or to third parties. In parallel the regulator assesses the managers themselves: their reputation, experience and the time they will commit. That part of the procedure is covered in the article on qualifying holdings and fit & proper, and the business plan in the article on the regulatory business plan.

In many regimes managers are approved individually before they start. The FCA approves senior managers under SMCR, the SFC approves responsible officers, and MAS approves the CEO, the resident director and the director responsible for the Singapore business of a CMS licensee. Applications for managers are filed together with the company's application: in Hong Kong the approval of responsible officers is considered alongside the licence itself. The team therefore has to exist at the filing stage.

Life as a licensee

Substance is a licence condition that applies continuously. The departure of a resident director, the exit of a responsible officer or a move of compliance into the group changes the picture the regulator approved. MiFID II requires an investment firm to notify the regulator of every change in the membership of its management body (Art. 9(5)), and in regimes with individual approval a new manager is approved before taking office. A change of owners follows a separate procedure, described in the article on change of control.

A breach can end in withdrawal of the licence; what happens to clients afterwards is covered in the article on licence withdrawal and wind-down.

Head office: where decisions are taken

A registered office and a head office are different things. The first is entered in the register; the second is the place from which the company is actually run. EU legislation requires both to be in the same state: Art. 11(3) PSD2 for a payment institution, which must also carry out at least part of its payment service business there; Art. 5(4) MiFID II for an investment firm; and Art. 13(2) CRD for a credit institution.

The clearest definition comes from the FCA. Neither MiFID nor the UK statute defines a head office, so COND 2.2.3G points to the location of central management and control. That is where the directors and other senior management who take decisions on the firm's central direction and its material day-to-day management decisions are located, and where the central administrative functions, such as central compliance and internal audit, are carried out. The condition itself, for a UK company, is a head office and registered office in the United Kingdom (COND 2.2.1A).

For asset managers the FCA has been explicit:

FCA, Asset management applications: what to consider, 15 April 2024: "We expect the mind and management of a firm to be in the UK, taking business decisions about portfolios and distribution, and effectively overseeing outsourced activities, in the UK on a day-to-day basis. It is not enough for a firm to do just its compliance or administration in the UK, or to have the people who make business decisions fly in from time to time."

MiCA frames the requirement differently: a CASP's registered office must be in a Member State where it provides at least part of its services, and its place of effective management must be in the Union, not necessarily in the licensing state (Art. 59(2) MiCA). How supervisors read this is covered in the article on outsourcing at a licensed firm. The Bulgarian payment services statute, under which the registered management address must match actual management, is covered in the article on EMIs in Bulgaria.

Management: the four-eyes principle

A credit institution or investment firm in the EU is authorised only if at least two persons effectively direct its business (Art. 13(1) CRD; Art. 9(6) MiFID II). This is the four-eyes principle: no material decision depends on a single person, and the supervisor always has a second interlocutor.

MiFID II allows an exception for investment firms that are natural persons and for firms managed by a single natural person under their constitution. The Member State must then require alternative arrangements that ensure sound and prudent management and due regard for clients' interests.

The word "effectively" carries the weight. A second manager who signs documents but takes no part in decisions does not satisfy the rule. In its 2018 supervisory expectations on booking models, addressed to banks under its supervision with capital markets activity and applied proportionately, the ECB expects them to have an onshore-based management body in its executive function with effective decision-making powers and full control of the balance sheet. The ECB also limits dual hatting within a group:

ECB, Supervisory expectations on booking models, August 2018: "Dual hatting and secondments of members of the management body, key function holders and staff employed by the SSM entity are expected to be used only in exceptional circumstances and in duly justified cases."

Outside the EU the principle is the same and only the form changes. In Hong Kong each type of regulated activity needs at least two responsible officers, one of them an executive director, and at least one must be available at all times (SFC licensing). MAS requires a CMS licensee to have at least two directors, one of whom is resident in Singapore.

Key function holders

Beyond the managers, the regulator looks at the people responsible for individual control functions. The joint EBA and ESMA guidelines on suitability of members of the management body and key function holders (EBA/GL/2021/06) have applied since 31 December 2021 to credit institutions and investment firms.

CRD VI carried this logic into the directive and split responsibility between the bank and the supervisor in three provisions.

The directive works through national law: Member States had to transpose it by 10 January 2026 and apply the rules from 11 January 2026. Transposition is running late: on 27 March 2026 the Commission sent letters of formal notice to 22 Member States, including Bulgaria, Cyprus and Lithuania. A revised version of the guidelines reflecting CRD VI was put out to consultation in 2026.

For an investment firm the set of functions is defined by Delegated Regulation 2017/565. Its Art. 22 requires a permanent, effective and independent compliance function with a compliance officer appointed by the management body. Proportionality is narrow here: a small firm may disapply only the requirements that compliance staff are not involved in the activities they monitor and on how they are paid (Art. 22(4)).

Risk management and internal audit functions (Arts 23 and 24) are established where appropriate and proportionate to the nature, scale and complexity of the business. A small firm may do without a separate risk management function but must be able to show on request that its policies work without one.

AML/CFT: compliance manager and compliance officer

From 10 July 2027 AML/CFT functions take a single form across the EU. Art. 11 AMLR requires two appointments.

A small, low-risk entity that is part of a group may give the compliance officer role to someone who performs it in another group entity. At the same time Art. 18 AMLR bars outsourcing the approval of the risk assessment and internal policies, decisions on a customer's risk profile and the decision to enter into a business relationship. The full system is described in the article on the compliance stack.

Personal accountability in the UK and Hong Kong

The UK and Hong Kong go further and attach responsibility for each function to a named individual.

Residence: who has to live in the licensing country

CRD, MiFID II and PSD2 do not require particular individuals to be resident: presence is defined by where decisions are taken. By the logic of the head-office definition, management working from another country moves the centre of management there too. In its 2017 opinion (para. 14) ESMA asked regulators to ensure that the persons effectively directing an investment firm, its senior management and key function holders are in the Member State of establishment and have effective decision-making powers even within a group.

MiCA is the exception: at least one director of a CASP must be resident in the Union. ESMA's supervisory briefing expects more — a member of the executive body resident in the licensing state and a CEO who, as a rule, works full-time for the CASP.

Singapore, the AIFC and offshore centres name residents directly. Singapore requires a resident CEO and a resident director for a CMS licence and, for a PSA payment licence, an executive director who is a citizen or permanent resident, or an Employment Pass holder where another director is a citizen or permanent resident (Singapore payment licences). In the AIFC a broker's MLRO is, as a rule, resident in Kazakhstan. In the Seychelles a licensed securities dealer keeps a full-time resident director. Hong Kong has no residence requirement: at least one responsible officer must be available at all times, and a Manager-In-Charge may work from abroad.

The UK formula stands apart. COND describes the head office through the place of central management and control and says nothing about the nationality or residence of individual managers. The presence requirement is no weaker for that: if decisions are taken abroad, the head-office condition is not met.

Outsourcing and the letter-box limit

A licensee may outsource functions to its group and to third parties, but responsibility stays with it. The limit is drawn in the same way across the European regimes: the firm must not become an empty shell or letter-box entity. Credit institutions, payment institutions and EMIs are bound by para. 39 of EBA/GL/2019/02; for investment firms ESMA (para. 43 of the 2017 opinion) directs supervisors to ensure that outsourcing does not exceed by a substantial margin the functions performed internally.

There is no numerical threshold. Supervisors ask who takes decisions, whether there is enough expertise and staff in-house to oversee providers, and what would remain if the group or the provider disappeared. In the same 2018 expectations the ECB ties this to headcount: a continuity plan is credible only if the bank employs a sufficient number of its own key function holders and staff with the right knowledge and authority.

EBA/GL/2026/09, published on 18 September 2026, will replace EBA/GL/2019/02 once it applies; it keeps the empty-shell ban and allows two years to review existing arrangements for critical or important functions. The detailed rules — critical or important functions, notification, providers in third countries — are set out in the article on outsourcing at a licensed firm. Arrangements in which a business operates under someone else's licence test the same boundary from the other side; see the article on licence for rent.

Minimum staffing by regime

The regimes agree on the two-manager rule and differ on who has to be on site. The table summarises people and presence requirements for licences covered in detail in separate articles.

The table yields a simple rule: almost nowhere is a licensee's minimum staffing smaller than two managers plus one person responsible for compliance and AML/CFT, and in Singapore, the AIFC and offshore centres a resident is added on top.

The boundary with tax substance

Tax economic substance answers a different question: whether income is earned where it is reported. Substance laws in the BVI, Cayman, Bermuda and other centres, the BEPS standards and EU anti-avoidance rules test whether the jurisdiction holds people, expenditure and decisions commensurate with the income, and failure leads to penalties, exchange of information and denial of tax benefits.

The evidence for the two regimes partly overlaps: local managers, an office, minutes of decisions, expenditure. The assessor, the test and the consequences differ. Regulatory substance is reviewed by the supervisor before authorisation and throughout the life of the licence, and the price of failure is refusal or withdrawal. A company can pass one test and fail the other, so the file is kept with both in mind; how it is assembled is described in the article on the substance dossier.