🇪🇺Qualifying Holdings and Fit & Proper: How Regulators Vet Owners and Managers

Concept

A financial licence is, in substance, granted to a specific group of people who will run the company. The regulator entrusts the licensee with other people's money, access to payment systems and a passport to a market, and that trust only makes sense while it knows who sets the strategy, who contributes and can withdraw capital, and who manages the business day to day. Every serious regime therefore vets two groups: owners, who can influence the firm through shares or votes, and managers, who take decisions on its behalf.

For owners, the EU and the UK use the concept of a qualifying holding: a direct or indirect holding of 10% or more of the capital or voting rights, or any stake that allows significant influence over management. In Hong Kong and Singapore the same role is played by the substantial shareholder and the controller. For managers the test is called fit and proper; in the EU it is the suitability assessment of members of the management body.

One test, three moments

The vetting of owners and managers is triggered three times over the life of a licence.

1. At authorisation. Art. 14 CRD and Art. 10 MiFID II require refusal if the regulator is not satisfied as to the suitability of qualifying holders; Art. 5(1) PSD2 and Art. 62 MiCA require them to be disclosed and their suitability evidenced; art. 6 PSD2 then carries the same control over the shareholding into the life of a payment institution.
2. On a change of control. A new owner passes the same test on the same criteria before closing.
3. On an ongoing basis. Managers must meet the requirements "at all times" (Art. 91(1) CRD), and the Seventh Schedule criteria of the Hong Kong Banking Ordinance, as the HKMA explains, continue to apply after authorisation.

The practical consequence is that suitability is not a one-off exam. A criminal case against a shareholder, a sanctions listing or an unexplained source of money that surfaces three years after licensing triggers the same mechanism as the application did.

What the test does not assess

The law expressly rules some questions out. An EU regulator may not impose prior conditions on the size of the holding to be acquired or examine the acquisition in terms of the economic needs of the market (Art. 23(3) CRD, Art. 84(3) MiCA), and the UK regulator may object to an acquisition only on the basis of the s.186 FSMA criteria or because the information provided is incomplete (s.185 FSMA). Nationality is not a criterion in itself: it matters only insofar as it affects reputation, transparency or money-laundering risk. The country where the acquirer is situated can count directly, but only for banks: since CRD VI an EU supervisor may object to an acquirer situated in an EU-listed high-risk third country or in a country subject to Union restrictive measures where this affects the acquirer's capacity to comply with anti-money-laundering rules. EU sanctions law goes further for crypto-asset service providers: it bars ownership, control and board seats by Russian nationals and residents without EU, EEA or Swiss nationality or a residence permit there, independently of the regulator's assessment.

The key parameters of the regimes as at 23 September 2026 fit into one table.

Two circles: owners and managers

Each circle has its own entry threshold and its own standard of assessment; the contractual mechanics of a transaction are covered in the article on change of control and buying a licensed company.

Owners: who counts as a qualifying holder

The European definition is the same across sectors. Art. 4(1)(36) CRR defines a qualifying holding as a direct or indirect holding of 10% or more of the capital or voting rights, or one that makes it possible to exercise significant influence over management. MiFID II and MiCA use the same construction, and PSD2 cross-refers to the CRR. The UK counterpart is s.181 FSMA: control arises at 10% of the shares or voting power in the licensee or its parent, or where significant influence can be exercised.

The Asian regimes count differently. In Hong Kong, SFC approval is needed to become a substantial shareholder of a licensed corporation, that is, to hold more than 10% of the shares or voting power, including through a chain of companies with 35% of the votes at each link (SFC Licensing Handbook). In Singapore, MAS approval is required to become a 20% controller of a payment services licensee (s.28 Payment Services Act), and the Minister's approval to become a substantial shareholder of a Singapore-incorporated bank, that is, to hold 5% or more of the votes, or a 12% or 20% controller of it (ss.15A and 15B Banking Act).

Managers: the management body and key persons

The European formula for managers contains more elements than the Asian ones. Art. 91 CRD places primary responsibility on the institution itself to ensure that members of the management body are at all times of sufficiently good repute and possess sufficient knowledge, skills and experience, commit sufficient time and act with independence of mind.

Art. 9 MiFID II requires refusal of an investment firm's authorisation if these conditions are not met; Art. 68 MiCA sets the same requirements for the management body of crypto-asset service providers (CASPs) and adds that neither its members nor shareholders with qualifying holdings may have been convicted of money-laundering, terrorist-financing or other offences affecting their good repute.

Managers in the UK, Hong Kong and Singapore

The UK has built a whole system around the approval of managers. Under s.59 FSMA a firm may not allow a person to perform a controlled function without the regulator's approval; this underpins the Senior Managers and Certification Regime (SM&CR). The criteria come from the FIT sourcebook: honesty, integrity and reputation (FIT 2.1), competence and capability (FIT 2.2), and financial soundness (FIT 2.3).

The SM&CR extends to FSMA-authorised firms; payment institutions (PIs) and electronic money institutions (EMIs) are authorised under the PSRs 2017 and the EMRs 2011, where managers pass their own test of good repute and appropriate knowledge and experience (reg. 6 PSRs).

Hong Kong and Singapore frame the criteria almost identically. Section 129 SFO requires regard to financial status, qualifications and experience, the ability to carry on the regulated activity competently, honestly and fairly, and reputation and reliability; a licensed corporation appoints at least two responsible officers for each regulated activity, one of whom is an executive director. Singapore's Guidelines on Fit and Proper Criteria (FSG-G01), as revised on 30 May 2025, apply to directors, CEOs, substantial shareholders and controllers.

Stripped of drafting differences, the UK FIT sourcebook, Hong Kong's s.129 and Singapore's FSG-G01 ask the same three questions.

Comparing the regimes

Different regulators ask the same questions at different thresholds and with different procedures for managers. The table sets out the owner threshold, how managers are approved and the underlying standard.

The grid shows that thresholds diverge noticeably while criteria nearly coincide. For a structure with stakes between 10% and 20%, the same shareholder falls under full vetting in a London bank or payment firm and in a Hong Kong licensed corporation, but may remain below the threshold in a Singapore payment licensee; under PSD2 itself, buying such a stake in an already authorised EU payment institution requires no notification, because art. 6(1) starts at 20%. For non-directive firms the FCA applies a single 20% band.

Crossing a threshold: what is notified, and when

Ten per cent is the entry point, not the only trigger. Under art. 22(1) of the CRD a proposed acquirer notifies the competent authority in writing before the transaction whenever a qualifying holding would be acquired, or increased so that the proportion of capital or voting rights reaches or exceeds 20%, 30% or 50%, or so that the institution becomes a subsidiary. Art. 11(1) MiFID II repeats the same ladder for investment firms; art. 6(1) PSD2 applies the 20%, 30% and 50% steps to payment institutions but does not make a 10% acquisition notifiable on its own. Art. 25 CRD imposes the mirror duty on the way down: a disposal that takes the holding below any of those thresholds is notified too.

The clock that then starts is short and strictly bounded.

Silence decides the matter: if the authority does not oppose in writing within the assessment period, the acquisition is deemed approved (art. 22(6) CRD). Until then the transaction stands still, and the Joint Guidelines add that an incomplete notification is acknowledged but does not start the 60 days at all, so completeness rather than filing sets the real starting point.

How the assessment runs

The procedure is built the same way everywhere, and it can be laid out as the sequence the supervisor itself follows.

1. The regulator establishes who is to be vetted: direct holders above the threshold, indirect holders through the chain, and those acting in concert with them.
2. Each person provides information about themselves: criminal record certificates, regulatory and litigation history, financial position and source of funds.
3. The regulator assesses the management that will run the company after the transaction or licensing.
4. The business plan is tested: will the licensee be able to comply with prudential requirements under the new owner.
5. The decision takes the form of approval, approval with conditions or objection; a fourth outcome also occurs — the applicant withdraws the notification.

The last point can be measured. In 2025 the ECB was notified of 110 acquisitions of or increases in qualifying holdings, and three of these notifications were withdrawn before a decision owing to a negative assessment (ECB Annual Report on supervisory activities 2025). In the same year it was notified of 1 672 fit and proper procedures, and an assessment took 113 days on average from notification to decision.

What is actually weighed

The list of questions is closed. Art. 23(1) CRD sets five criteria and no others, and the Joint Guidelines devote one section to each; art. 13 MiFID II and art. 84 MiCA reproduce the same list for investment firms and CASPs, while art. 6 PSD2 asks a single question for payment institutions: whether the acquirer's influence is likely to operate to the detriment of their sound and prudent management.

Three of the five decide most cases, and each turns on evidence the acquirer has to assemble rather than on a judgement about the market.

Reputation: integrity and professional competence

The ECB Guide on qualifying holding procedures breaks an acquirer's reputation into two elements: integrity and professional competence. The minimum proof is a criminal record certificate from the country of residence. The presumption of innocence works differently here than in criminal proceedings: reputation must be beyond doubt, so the assessment may be negative while a trial is still ongoing.

The FCA's FG24/5 guidance follows the same two-part structure. Good repute is presumed in the absence of reliable evidence to the contrary, and criminal and administrative records are weighed by the type of offence, the stage of proceedings, the severity of the sanction and the effect of rehabilitation.

Financial soundness and source of capital

For the ECB, financial soundness has two dimensions: the capacity to finance the acquisition and the capacity to maintain a sound financial structure at the acquirer and the target for the foreseeable future, usually three years. Debt-financed purchases receive particular attention: supervisors fear that the debt may push the target to chase short-term profits or lead to resources being extracted from it to service the debt. Under FG24/5 the FCA may then request loan agreements and evidence of the ability to repay.

Two different questions meet here, and in practice they are often confused.

In Hong Kong the SFC expressly reserves the right to enquire into a proposed substantial shareholder's source of funding and financial strength. Which documents answer these questions is covered in the article on source of funds and source of wealth. The licence's own capital requirement sets the floor for all of this: it fixes how much money the acquirer has to explain in the first place, and how that figure is built for each type of licence is set out in regulatory capital.

Transparency of the chain: trusts and funds

Owners rarely hold a stake directly. For indirect holdings the ESMA, EBA and EIOPA Joint Guidelines JC/GL/2016/01 apply a two-step test. First comes the control criterion: whoever controls a direct holder of a qualifying holding is treated as indirectly acquiring the whole of that holding. Only where there is no control is the multiplication criterion applied, multiplying percentages up the chain until the result falls below 10%. A natural person at the top of the chain becomes an indirect acquirer if they control the chain or if the multiplied stake attributable to them reaches 10%.

The diagram shows a typical chain and whom the regulator sees in it.

For a trust, Annex I to JC/GL/2016/01 requires disclosure of all trustees managing the trust assets and of all beneficial owners or settlors with their shares in the distribution of income.

For private equity and hedge funds it requires the track record of previous acquisitions of financial institutions, the investment and exit policy, the decision-making framework and AML procedures. For sovereign wealth funds it requires details of any influence of the responsible ministry on the day-to-day operations of the fund and the target. Hong Kong expressly includes ownership through a trust in the concept of an ultimate owner of an MSO holding more than 25% (Customs licensing guide).

The practical conclusion: a trust or fund in the chain lengthens the list of people to be vetted. How trustee roles and beneficial ownership disclosure work is covered in the article on beneficial ownership.

Why applications fail

Refusals almost always come down to one of the criteria, and they can be mapped to the rules.

All six reasons fit within a closed list of criteria that excludes deal size, economic need and nationality, which is why refusals almost always come down to money, history or structure.

An illustrative case is the FCA Final Notice of 4 December 2024: the regulator objected to the acquisition of Olampicaran Limited, a small money remittance firm, citing the acquirer's lack of professional competence and the risk of increased money laundering. His earlier conduct as a controlling shareholder, without due skill, care and diligence and compliance with the relevant standards, proved decisive.

Nationality and the EU sanctions perimeter

Neither the CRD, PSD2, MiFID II and MiCA, nor UK FSMA Part XII, nor Hong Kong's SFO and Banking Ordinance, nor Singapore's PSA and Banking Act contain a nationality criterion. The decision is taken on the same points — reputation, competence, financial soundness, transparency, money-laundering risk. Two EU instruments nevertheless bring the acquirer's country or nationality into the analysis directly. For banks, CRD VI lets the supervisor object to an acquirer situated in an EU-listed high-risk third country or in a country subject to Union restrictive measures where this affects its capacity to comply with anti-money-laundering rules; Russia meets both limbs, since it is subject to Union restrictive measures and has been on the EU high-risk list since 29 January 2026 (Delegated Regulation (EU) 2026/46). EU sanctions law adds restrictions that operate regardless of the regulator's assessment.

Where EU sanctions reach ownership itself

The only direct ownership ban concerns the crypto sector. Since 18 January 2024, Art. 5b(2a) of Regulation 833/2014 has prohibited allowing Russian nationals and natural persons residing in Russia to directly or indirectly own or control, or hold posts in the governing bodies of, EU entities providing crypto-asset wallet, account or custody services.

From 25 August 2026, under Council Regulation (EU) 2026/1848 of 23 July 2026, the ban extends to providers of any crypto-asset service within the meaning of MiCA. Under Art. 5b(3) it does not apply to nationals of the EU, the EEA and Switzerland, or to holders of a temporary or permanent residence permit there.

Where sanctions constrain the business and the structure

The remaining rules concern the business model and the construction of the holding structure; they are easiest to compare by what exactly they restrict.

The table shows that a Russian national without EU nationality or a residence permit may own a payment institution in the EU, but the institution may not issue payment instruments or e-money to, or provide acquiring or payment initiation for, Russian nationals and residents without such status or entities established in Russia; other payment services, such as money remittance, fall outside Art. 5b(2). EU providers also may not set up or administer a trust through which that person would hold the stake. The Art. 5b(3) exemption for EU, EEA or Swiss nationality or a residence permit covers natural persons only, not companies. Like Art. 5b, Art. 5m does not apply where the settlor or beneficiary holds EU, EEA or Swiss nationality or a residence permit there. The 50% rule for the freeze comes from the Council's best practices on applying Regulation 269/2014.

In Hong Kong and Singapore there are no nationality restrictions on owners and managers of licensees: the SFO, Banking Ordinance and FSG-G01 criteria do not mention nationality. Singapore applies targeted measures to the Russian sector: Notice SNR-N01 prohibits financial institutions from dealing with listed banks and entities and requires their assets to be frozen.

Banks and accounts

A licence without an account does not work, and here the filter is different. Art. 36 PSD2 requires Member States to ensure that payment institutions have access to credit institutions' payment account services on an objective, non-discriminatory and proportionate basis, and a bank must give the competent authority duly motivated reasons for a refusal.

EBA Guidelines EBA/GL/2023/04 bar banks from refusing entire categories of customers they have assessed as higher risk and require an individual assessment. The decision on a particular account still rests with the bank and its risk policy. How screening works on the side of a financial operator is covered in the article on sanctions screening, and the choice of jurisdiction for a founder with Russian UBOs in the map of financial licences.

Change of control and change of managers

On a change of owner the same five criteria apply as at licensing, on the timetable set out above. What the deal itself then has to look like — conditions precedent, how the standstill is written into a share purchase agreement, and how the requirement plays out jurisdiction by jurisdiction — is covered in the article on change of control.

A change of managers with the same shareholders is a separate approval event. In Singapore a payment licensee may not appoint a CEO or director without MAS approval (s.34 PSA), in Hong Kong a bank obtains the HKMA's consent for its CEO and directors (s.71 Banking Ordinance), and in the UK senior managers are pre-approved under s.59 FSMA.

What changes in 2026

Four developments shape the regime in 2026, and as at 24 September 2026 only some of them are in force.

Until PSD3 is adopted, PSD2 and EMD2 continue to apply to payment and e-money institutions. For acquirers of banks, the CRD VI change that matters most sits in art. 23(1): point (e) now refers to Directive (EU) 2015/849, the supervisor must consult the anti-money-laundering supervisor, whose negative opinion may itself justify opposition, and it may object to an acquirer situated in an EU-listed high-risk third country or in a country subject to Union restrictive measures where this affects the acquirer's capacity to comply with AML rules.