# Licensee Substance: People, Office and Functions

> Regulatory substance of a financial licence: head office in the licensing state, the two-manager rule, key function holders, resident directors and the outsourcing limit in the EU, UK, Hong Kong and Singapore.

Author: Gordey Bolotko — Partner, Corporate & Commercial (https://wiki.private.law/en/authors/bolotko)
Last modified: 2026-10-05T00:00:00.000Z
Canonical: https://wiki.private.law/en/licensee-substance
Publisher: wiki.private.law (https://wiki.private.law)
Version: 9b5393a0e3b8adc31eef597ea2427dcb29cffc7208c53b2ea5ba782e6821bd09
Cite as: Licensee Substance: People, Office and Functions. wiki.private.law. https://wiki.private.law/en/licensee-substance. Version 9b5393a0e3b8adc31eef597ea2427dcb29cffc7208c53b2ea5ba782e6821bd09.
Topics: structures
Jurisdictions: eu, uk, hong-kong, singapore, kazakhstan, cyprus, lithuania, bulgaria, seychelles
Functional tags: substance, license
Product tags: substance, compliance, company
Semantic tags: substance, license, compliance, company

---

## Concept

A financial licence is granted to a specific company in a specific country, and the regulator expects that company to exist there in fact. Decisions are taken by people the regulator has approved and can call in; control functions operate inside the company or under its genuine control; the office is the place from which the company is run. This set of requirements about people, place and functions is what is meant by a licensee's regulatory substance.

The requirement follows from the logic of supervision. A regulator answers for the company it has authorised and, in the EU, for everything that company does in other Member States under its passport. If management sits in a third country while the group performs compliance and operations, supervision has nothing to reach: there is no one to hold to account and nothing to inspect. EU, UK, Hong Kong and Singapore law therefore express substance through the same three questions: where the head office is, who effectively directs the business and who is responsible for the key functions.

Substance has three elements, and each is tested separately.

**People**

At least two persons who effectively direct the business; approved key function holders; in some regimes a director or CEO resident in the licensing country.

**Place**

A head office in the licensing state, understood as the place where management takes strategic and day-to-day decisions; the registered address is a separate concept.

**Functions**

Compliance, risk management, internal audit and AML/CFT run in-house or are outsourced in a way that leaves the licensee in control.

None of these elements is a number that can be met on paper. The regulator assesses the whole picture: how many people, with what authority, where they work and what remains in-house after outsourcing. The rules behind that assessment:

| Parameter | Content |
| --- | --- |
| Head office | In the licensing state: Art. 11(3) PSD2, Art. 5(4) MiFID II, Art. 13(2) CRD, FCA COND 2.2; for a CASP, office where part of services is provided, management in the EU (Art. 59(2) MiCA) |
| Management | At least two persons effectively directing the business: Art. 13(1) CRD, Art. 9(6) MiFID II |
| Key function holders | Arts 91a and 88(3) CRD (applicable from 11 January 2026 through national law); EBA and ESMA suitability guidelines |
| Control functions | Compliance permanently, risk management and internal audit where proportionate: Arts 22–24 of Regulation 2017/565 |
| AML/CFT | Compliance manager and compliance officer under Art. 11 AMLR from 10 July 2027 |
| Limit on outsourcing | No letter-box entities: para. 39 EBA/GL/2019/02, para. 43 of the 2017 ESMA opinion |
| Tax substance | A separate regime with different tests and consequences |

The table shows the common pattern; regimes differ in the detail, some naming resident individuals and others speaking only of where decisions are taken.

## How substance is tested: from application to withdrawal

### Application

Testing starts with the business plan and the organisation chart. The applicant shows who sits on the management body, who is responsible for compliance, risk and AML/CFT, where these people work and which functions are outsourced to the group or to third parties. In parallel the regulator assesses the managers themselves: their reputation, experience and the time they will commit. That part of the procedure is covered in the article on [qualifying holdings and fit & proper](https://wiki.private.law/en/qualifying-holding-fit-proper), and the business plan in the article on the [regulatory business plan](https://wiki.private.law/en/regulatory-business-plan).

In many regimes managers are approved individually before they start. The FCA approves senior managers under SMCR, the SFC approves responsible officers, and MAS approves the CEO, the resident director and the director responsible for the Singapore business of a CMS licensee. Applications for managers are filed together with the company's application: in Hong Kong the approval of responsible officers is considered alongside the licence itself. The team therefore has to exist at the filing stage.

### Life as a licensee

Substance is a licence condition that applies continuously. The departure of a resident director, the exit of a responsible officer or a move of compliance into the group changes the picture the regulator approved. MiFID II requires an investment firm to notify the regulator of every change in the membership of its management body (Art. 9(5)), and in regimes with individual approval a new manager is approved before taking office. A change of owners follows a separate procedure, described in the article on [change of control](https://wiki.private.law/en/license-change-of-control).

A breach can end in withdrawal of the licence; what happens to clients afterwards is covered in the article on [licence withdrawal and wind-down](https://wiki.private.law/en/license-wind-down).

> 💡 In July 2025 MAS revoked the CMS licence of Xen Capital Asia. Among the grounds, the company had not told the regulator that its full-time representatives had fallen below two per regulated activity, and it lacked a commensurate compliance function. Details are in the article on [Singapore CMS licences](https://wiki.private.law/en/singapore-cms-dealing-fa).

## Head office: where decisions are taken

A registered office and a head office are different things. The first is entered in the register; the second is the place from which the company is actually run. EU legislation requires both to be in the same state: [Art. 11(3) PSD2](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02015L2366-20250117) for a payment institution, which must also carry out at least part of its payment service business there; [Art. 5(4) MiFID II](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02014L0065-20240328) for an investment firm; and [Art. 13(2) CRD](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02013L0036-20250117) for a credit institution.

The clearest definition comes from the FCA. Neither MiFID nor the UK statute defines a head office, so [COND 2.2.3G](https://www.handbook.fca.org.uk/handbook/COND/2/2.html) points to the location of central management and control. That is where the directors and other senior management who take decisions on the firm's central direction and its material day-to-day management decisions are located, and where the central administrative functions, such as central compliance and internal audit, are carried out. The condition itself, for a UK company, is a head office and registered office in the United Kingdom (COND 2.2.1A).

For asset managers the FCA has been explicit:

> [FCA, Asset management applications: what to consider](https://www.fca.org.uk/firms/authorisation/wholesale-markets/asset-management-applications-what-to-consider), 15 April 2024: "We expect the mind and management of a firm to be in the UK, taking business decisions about portfolios and distribution, and effectively overseeing outsourced activities, in the UK on a day-to-day basis. It is not enough for a firm to do just its compliance or administration in the UK, or to have the people who make business decisions fly in from time to time."

MiCA frames the requirement differently: a CASP's registered office must be in a Member State where it provides at least part of its services, and its place of effective management must be in the Union, not necessarily in the licensing state ([Art. 59(2) MiCA](https://eur-lex.europa.eu/eli/reg/2023/1114/oj)). How supervisors read this is covered in the article on [outsourcing at a licensed firm](https://wiki.private.law/en/outsourcing-licensed-firms). The Bulgarian payment services statute, under which the registered management address must match actual management, is covered in the article on [EMIs in Bulgaria](https://wiki.private.law/en/bulgaria-emi-license).

## Management: the four-eyes principle

A credit institution or investment firm in the EU is authorised only if at least two persons effectively direct its business ([Art. 13(1) CRD](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02013L0036-20250117); [Art. 9(6) MiFID II](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02014L0065-20240328)). This is the four-eyes principle: no material decision depends on a single person, and the supervisor always has a second interlocutor.

MiFID II allows an exception for investment firms that are natural persons and for firms managed by a single natural person under their constitution. The Member State must then require alternative arrangements that ensure sound and prudent management and due regard for clients' interests.

The word "effectively" carries the weight. A second manager who signs documents but takes no part in decisions does not satisfy the rule. In its 2018 [supervisory expectations on booking models](https://www.bankingsupervision.europa.eu/framework/relocating/shared/pdf/ssm.supervisoryexpectationsbookingmodels_201808.en.pdf), addressed to banks under its supervision with capital markets activity and applied proportionately, the ECB expects them to have an onshore-based management body in its executive function with effective decision-making powers and full control of the balance sheet. The ECB also limits dual hatting within a group:

> ECB, Supervisory expectations on booking models, August 2018: "Dual hatting and secondments of members of the management body, key function holders and staff employed by the SSM entity are expected to be used only in exceptional circumstances and in duly justified cases."

Outside the EU the principle is the same and only the form changes. In Hong Kong each type of regulated activity needs at least two responsible officers, one of them an executive director, and at least one must be available at all times ([SFC licensing](https://wiki.private.law/en/sfc-licensing-hong-kong)). MAS requires a CMS licensee to have at least two directors, one of whom is resident in Singapore.

## Key function holders

Beyond the managers, the regulator looks at the people responsible for individual control functions. The joint [EBA and ESMA guidelines on suitability](https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/internal-governance/joint-esma-and-eba-guidelines-assessment-suitability-members-management-body) of members of the management body and key function holders (EBA/GL/2021/06) have applied since 31 December 2021 to credit institutions and investment firms.

CRD VI carried this logic into the [directive](https://eur-lex.europa.eu/eli/dir/2024/1619/oj) and split responsibility between the bank and the supervisor in three provisions.

| Provision | What it requires |
| --- | --- |
| Art. 91a CRD | Credit institutions and other entities under Art. 91 ensure that key function holders are at all times of good repute, honest and knowledgeable |
| Art. 88(3) CRD | Individual statements of duties for executive board members, senior management and key function holders, and a mapping of duties |
| Art. 91a(5) CRD | The supervisor itself assesses heads of internal control functions and the CFO of large institutions |

The directive works through national law: Member States had to transpose it by 10 January 2026 and apply the rules from 11 January 2026. Transposition is running late: on 27 March 2026 the Commission sent letters of formal notice to 22 Member States, including Bulgaria, Cyprus and Lithuania. A revised version of the guidelines reflecting CRD VI was put out to [consultation](https://www.esma.europa.eu/sites/default/files/2026-03/Consultation_Paper_on_revised_joint_Guidelines_on_the_assessment_of_the_suitability_of_members_of_the_management_body_and_key_function_holders__TRACK_CHANGES_.pdf) in 2026.

For an investment firm the set of functions is defined by [Delegated Regulation 2017/565](https://eur-lex.europa.eu/eli/reg_del/2017/565/oj). Its Art. 22 requires a permanent, effective and independent compliance function with a compliance officer appointed by the management body. Proportionality is narrow here: a small firm may disapply only the requirements that compliance staff are not involved in the activities they monitor and on how they are paid (Art. 22(4)).

Risk management and internal audit functions (Arts 23 and 24) are established where appropriate and proportionate to the nature, scale and complexity of the business. A small firm may do without a separate risk management function but must be able to show on request that its policies work without one.

### AML/CFT: compliance manager and compliance officer

From 10 July 2027 AML/CFT functions take a single form across the EU. [Art. 11 AMLR](https://eur-lex.europa.eu/eli/reg/2024/1624/oj) requires two appointments.

| Role | Who | Responsible for |
| --- | --- | --- |
| Compliance manager | A member of the management body in its management function | Compliance with AMLR, adequate resources, information on control weaknesses |
| Compliance officer | An individual of sufficiently high standing appointed by the management body | Day-to-day policies and controls, contact with supervisors, reports to the FIU |

A small, low-risk entity that is part of a group may give the compliance officer role to someone who performs it in another group entity. At the same time [Art. 18 AMLR](https://eur-lex.europa.eu/eli/reg/2024/1624/oj) bars outsourcing the approval of the risk assessment and internal policies, decisions on a customer's risk profile and the decision to enter into a business relationship. The full system is described in the article on the [compliance stack](https://wiki.private.law/en/compliance-stack).

### Personal accountability in the UK and Hong Kong

The UK and Hong Kong go further and attach responsibility for each function to a named individual.

**UK: SMCR**

The CEO, chair, head of compliance oversight and MLRO are approved by the FCA before starting and receive a statement of responsibilities. Details are in the article on the [FCA investment firm](https://wiki.private.law/en/uk-investment-firm-fca).

**Hong Kong: Managers-In-Charge**

The SFC [identified eight core functions](https://apps.sfc.hk/edistributionWeb/gateway/EN/circular/doc?refNo=16EC68), including overall management oversight, risk management and compliance, each with a named manager. That manager may live outside Hong Kong but reports to the board or to the manager in charge of overall oversight.

## Residence: who has to live in the licensing country

CRD, MiFID II and PSD2 do not require particular individuals to be resident: presence is defined by where decisions are taken. By the logic of the head-office definition, management working from another country moves the centre of management there too. In its [2017 opinion](https://www.esma.europa.eu/sites/default/files/library/esma35-43-762_opinion_to_support_supervisory_convergence_in_the_area_of_investment_firms_in_the_context_of_the_united_kingdom_withdrawing_from_the_european_union.pdf) (para. 14) ESMA asked regulators to ensure that the persons effectively directing an investment firm, its senior management and key function holders are in the Member State of establishment and have effective decision-making powers even within a group.

MiCA is the exception: at least one director of a CASP must be resident in the Union. ESMA's supervisory briefing expects more — a member of the executive body resident in the licensing state and a CEO who, as a rule, works full-time for the CASP.

Singapore, the AIFC and offshore centres name residents directly. Singapore requires a resident CEO and a resident director for a CMS licence and, for a PSA payment licence, an executive director who is a citizen or permanent resident, or an Employment Pass holder where another director is a citizen or permanent resident ([Singapore payment licences](https://wiki.private.law/en/singapore-psa-payments)). In the AIFC a broker's MLRO is, as a rule, resident in Kazakhstan. In the Seychelles a licensed securities dealer keeps a full-time resident director. Hong Kong has no residence requirement: at least one responsible officer must be available at all times, and a Manager-In-Charge may work from abroad.

The UK formula stands apart. COND describes the head office through the place of central management and control and says nothing about the nationality or residence of individual managers. The presence requirement is no weaker for that: if decisions are taken abroad, the head-office condition is not met.

> 🧭 A separate restriction applies to Russian nationals and residents in EU crypto businesses. [Art. 5b(2a) of Regulation 833/2014](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02014R0833-20260724) prohibits them from owning, controlling or holding any post in the governing bodies of an EU entity providing crypto-asset wallet, account or custody services and, from 25 August 2026, any other crypto-asset services under MiCA. Under Art. 5b(3) the prohibition does not apply to nationals of the EU, the EEA or Switzerland or to holders of a residence permit there.

## Outsourcing and the letter-box limit

A licensee may outsource functions to its group and to third parties, but responsibility stays with it. The limit is drawn in the same way across the European regimes: the firm must not become an empty shell or letter-box entity. Credit institutions, payment institutions and EMIs are bound by [para. 39 of EBA/GL/2019/02](https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf); for investment firms ESMA (para. 43 of the 2017 opinion) directs supervisors to ensure that outsourcing does not exceed by a substantial margin the functions performed internally.

There is no numerical threshold. Supervisors ask who takes decisions, whether there is enough expertise and staff in-house to oversee providers, and what would remain if the group or the provider disappeared. In the same 2018 expectations the ECB ties this to headcount: a continuity plan is credible only if the bank employs a sufficient number of its own key function holders and staff with the right knowledge and authority.

EBA/GL/2026/09, published on 18 September 2026, will replace EBA/GL/2019/02 once it applies; it keeps the empty-shell ban and allows two years to review existing arrangements for critical or important functions. The detailed rules — critical or important functions, notification, providers in third countries — are set out in the article on [outsourcing at a licensed firm](https://wiki.private.law/en/outsourcing-licensed-firms). Arrangements in which a business operates under someone else's licence test the same boundary from the other side; see the article on [licence for rent](https://wiki.private.law/en/license-for-rent).

## Minimum staffing by regime

The regimes agree on the two-manager rule and differ on who has to be on site. The table summarises people and presence requirements for licences covered in detail in separate articles.

| Regime | People | Place and residence | Details |
| --- | --- | --- | --- |
| Credit institution, EU (CRD) | At least two persons effectively directing; key function holders under Art. 91a | Head office in state of registration; executive body in the EU (ECB) | [EU banking licence](https://wiki.private.law/en/eu-banking-license-ecb) |
| Investment firm, EU (MiFID II) | At least two persons effectively directing; permanent compliance | Head office in state of registration | [MiFID II investment firm](https://wiki.private.law/en/mifid-investment-firm) |
| CIF, Cyprus | At least two persons effectively directing; risk and internal audit where proportionate | Cypriot company | [CySEC CIF](https://wiki.private.law/en/cysec-cif-license) |
| EMI, Lithuania | Board and head of administration ([Art. 16(1) Law on Electronic Money](https://e-seimas.lrs.lt/rs/actualedition/TAIS.415752/CiNvofxtUR/)) | Head office in Lithuania | [EMI in Lithuania](https://wiki.private.law/en/emi-license-lithuania) |
| CASP, EU (MiCA) | At least one director resident in the EU | Office in a state where part of the services is provided; place of effective management in the EU | [CASP in Bulgaria](https://wiki.private.law/en/bulgaria-casp-license) |
| Investment firm, UK | Senior managers approved by the FCA | Head office and registered office in the UK | [FCA investment firm](https://wiki.private.law/en/uk-investment-firm-fca) |
| SFC licensee, Hong Kong | At least two ROs per type, one an executive director | At least one RO available at all times | [SFC licensing](https://wiki.private.law/en/sfc-licensing-hong-kong) |
| CMS (dealing), Singapore | Two directors, resident CEO, at least two full-time representatives per activity | One resident director; office in Singapore | [CMS and FA in Singapore](https://wiki.private.law/en/singapore-cms-dealing-fa) |
| AIFC broker, Kazakhstan | Four positions approved by the AFSA | MLRO, as a rule, resident in Kazakhstan | [Broker in Kazakhstan](https://wiki.private.law/en/kazakhstan-broker-license) |
| Securities dealer, Seychelles | Two directors; at all times two residents among directors, managers or compliance officers | Full-time resident director, office | [Offshore broker licences](https://wiki.private.law/en/offshore-broker-licenses) |

The table yields a simple rule: almost nowhere is a licensee's minimum staffing smaller than two managers plus one person responsible for compliance and AML/CFT, and in Singapore, the AIFC and offshore centres a resident is added on top.

## The boundary with tax substance

Tax [economic substance](https://wiki.private.law/en/economic-substance) answers a different question: whether income is earned where it is reported. Substance laws in the BVI, Cayman, Bermuda and other centres, the BEPS standards and EU anti-avoidance rules test whether the jurisdiction holds people, expenditure and decisions commensurate with the income, and failure leads to penalties, exchange of information and denial of tax benefits.

The evidence for the two regimes partly overlaps: local managers, an office, minutes of decisions, expenditure. The assessor, the test and the consequences differ. Regulatory substance is reviewed by the supervisor before authorisation and throughout the life of the licence, and the price of failure is refusal or withdrawal. A company can pass one test and fail the other, so the file is kept with both in mind; how it is assembled is described in the article on the [substance dossier](https://wiki.private.law/en/substance-dossier).

> ⚠️ **Where substance most often fails.** Group executives hold posts in the licensee and fly in for board meetings. A resident director signs documents but takes no decisions. Compliance and AML/CFT are performed entirely by the group in a third country, with no one in-house able to oversee it. The only resident or responsible officer leaves and the replacement is not cleared with the regulator. Any of these can become grounds for refusal or withdrawal of the licence.

> 🍓 Office floor space is secondary for a regulator. What it looks for is the answer to one question: where, and by whom, are the decisions taken that the licensee answers for. The two-manager rule, key function holders, a head office in the licensing state and the limit on outsourcing are four ways of testing that answer.

## Q/A

### People and office

### **Can a licensee be run from another country?**

People abroad can take part in management, but the centre of decision-making must stay in the licensing country. Under EU and UK rules the head office is where management takes strategic and day-to-day decisions, so running the firm from abroad moves the head office abroad as well. For CASPs the law adds an EU-resident director; Singapore names residents individually, while Hong Kong has no residence requirement.

### **Is one resident director enough?**

For EU credit institutions and investment firms two persons must effectively direct the business, and residence alone does not replace them. One EU-resident director is the MiCA minimum for a CASP, but ESMA expects a member of the executive body resident in the licensing state. In Singapore both the CEO and one of the directors must be resident.

### **Can a group executive hold a post in the licensee?**

Yes, if they have the time and authority and conflicts of interest are manageable. The ECB treats dual hatting and secondments as exceptions requiring justification, and the EBA and ESMA suitability guidelines separately assess the time a manager devotes to the firm.

### Functions and outsourcing

### **Can compliance and AML/CFT be outsourced to the group or a provider?**

Operational tasks, yes; responsibility, no. The licensee must keep people able to oversee the provider and must not become a letter-box entity. From 10 July 2027 AMLR requires its own compliance manager on the management body and a compliance officer; only a small, low-risk group entity may share its compliance officer with the group.

### **How many people are needed at the start?**

The typical minimum is two managers and a person responsible for compliance and AML/CFT; in Singapore full-time representatives per regulated activity, notified to MAS, come on top, and in Hong Kong responsible officers per regulated activity. Actual headcount follows from the business plan: the regulator matches people to the volume and risks of the services applied for.

### **Does regulatory substance cover tax substance?**

No. Part of the evidence is shared, but the tax test checks whether income matches activity, while the regulatory test checks whether the company can meet its licence conditions. The two are maintained in parallel.

---

## Factual claims

- A breach can end in withdrawal of the licence; what happens to clients afterwards is covered in the article on licence withdrawal and wind-down.
- A credit institution or investment firm in the EU is authorised only if at least two persons effectively direct its business (Art. 13(1) CRD; Art. 9(6) MiFID II).
- CRD VI carried this logic into the directive and split responsibility between the bank and the supervisor in three provisions.
- For an investment firm the set of functions is defined by Delegated Regulation 2017/565. Its Art. 22 requires a permanent, effective and independent compliance function with a compliance officer appointed by the management body.
- Risk management and internal audit functions (Arts 23 and 24) are established where appropriate and proportionate to the nature, scale and complexity of the business.
- From 10 July 2027 AML/CFT functions take a single form across the EU.
- CRD, MiFID II and PSD2 do not require particular individuals to be resident: presence is defined by where decisions are taken.
- EBA/GL/2026/09, published on 18 September 2026, will replace EBA/GL/2019/02 once it applies; it keeps the empty-shell ban and allows two years to review existing arrangements for critical or important functions.

---

Source: wiki.private.law — the private.law legal knowledge base. When quoting, cite the canonical page URL.
Consultation with a lawyer: https://t.me/private_law_bot