To date, commentary on CRD VI has centred around Article 21c requiring third-country lenders to establish an authorised branch or subsidiary to commence, or continue, providing ‘core banking services’ into the EU. This insight discusses what other CRD VI changes credit institutions authorised in the EU ought to be aware of.
Prior-approval Rules for mergers & divisions, material asset transfers and material acquisitions and disposals
CRD VI provides for new rules requiring credit institutions to notify their national competent authority in advance of certain M&A transactions and, in some cases, to obtain a so-called positive supervisory opinion before completing them.
The existing rules governing the acquisition or disposal of “qualifying holdings” (a direct or indirect holding in an undertaking which represents 10% or more of the capital or of the voting rights or which makes it possible to exercise a significant influence over the management of that undertaking) in CRD IV continue to apply. The updates made by CRD VI aligns the criteria for qualifying holdings with the new regime for “material holdings” which are holdings equal to or more than 15% of the eligible capital of the proposed acquirer.
CRD VI includes three broad categories of activity that require competent authority prior approval, namely:
- acquisitions or divestitures of material holdings – such acquisitions require supervisory approval prior to completion, whilst divestitures require only notification;
- material transfers of assets or liabilities where the transaction is at least 10% of the transferring entity’s total assets or liabilities, or 15% for transfers within the same group must be notified to the national competent authority in advance of the transfer; and
- require the prior approval of the relevant competent authority.
When assessing a merger or division, the national competent authority will assess, among other things:
- the reputation and financial soundness of the parties;
- whether the resulting entity will remain compliant with prudential requirements; and
- whether there are reasonable grounds to suspect money laundering or terrorist financing in connection with the transaction.
These provisions bring in new filing and timing obligations for ordinary M&A and balance-sheet restructuring activity. Credit institutions who are coordinating group reorganisations, portfolio transfers or merger plans should incorporate the assessment and notification obligations into their deal’s timetable.
Internal suitability assessments
Credit institutions will already be familiar with certain governance requirements imposed under CRD IV. For example, CRD IV allocates credit institutions with the primary responsibility for ensuring that members of the management body possess the necessary skills and character to perform their duties. CRD VI now requires credit institutions to carry out internal suitability assessments, both prior to the appointment and on an ongoing basis, to ensure that members of the management body:
- are of good repute and act with honesty and integrity;
- act with independence of mind to effectively assess and challenge the decisions of the management body where necessary and to effectively oversee and monitor management decision-making; and
- possess adequate collective knowledge, skills and experience to understand the bank’s activities, the associated risks it is exposed to, and the impacts it creates, taking into account ESG factors.
The updates brought in by CRD VI also require credit institutions to ensure that the overall composition of the management body reflects an adequately broad range of experience. To this end, they must look for a broad set of qualities and competences when recruiting members and proportionally promote diversity and gender balance in the management body.
Furthermore, CRD VI introduces the concept of “key function holders” via the insertion of Article 91a to CRD IV that requires banks to conduct suitability assessments to ensure that, prior to appointment and on an ongoing basis, key function holders are of good repute, act with honesty and integrity and possess sufficient knowledge, skills and experience necessary to perform their duties.
The European Banking Authority (the “EBA”) is currently finalising its revised Guidelines on Internal Governance, which will provide banks with further guidance on the scope of the governance requirements under the updated CRD regime. Further information on the consultation on the revised suitability assessment framework for banks and investment firms can be found here.
ESG and Crypto-Asset Definitions Enter the Prudential Framework
ESG risk
CRD VI introduces defined terms for “environmental, social and governance risk” (“ESG risk”) and “climate neutrality” into CRD IV, anchoring such concepts in the CRD regime by way of reference to Regulation (EU) 575/2013 (Capital Requirements Regulation).
CRD VI introduces new ESG risk management obligations for credit institutions. For example, EU banks are now required to systematically identify, measure and manage ESG risks, with particular priority given to climate-related and environmental risks. As part of this procedure, banks must prepare and maintain plans to address the financial risks arising from ESG factors over the short, medium and long-term. Banks are also required to carry out resilience testing in respect of long-term negative impacts of ESG factors, starting with climate-related factors.
The EBA has published its final Guidelines on the management of ESG risks, which are designed to provide further clarity to banks on how fulfil their ESG related obligations under the CRD regime. Earlier this year, the EBA also published its draft methodology, templates and guidance for the 2027 EU-wide stress test which includes the incorporation of climate risks for the first time. We include a link to the final Guidelines here and the EBA 2027 EU-wide Stress Test Draft Template Guidance here.
Crypto-assets
CRD VI defines “crypto-asset” by reference to Regulation (EU) 2023/1114 (Markets in Crypto-Assets Regulation), deliberately threading CRD VI together with the EU’s legislative framework for crypto-asset regulation. As part of the CRD VI updates to Chapter 2 (Review Processes) of CRD IV relating to crypto-assets EU banks are required to:
- under Article 79 of CRD IV (Credit and counterparty risk), carry out a prior assessment of any crypto-asset exposure they intend to take on and of the adequacy of existing processes and procedures to manage counterparty risk;
- under Article 83 of CRD IV (Market risk), report on such crypto-exposure assessments to their relevant supervisory authority; and
- under Article 85 of CRD IV (Operational risk), implement policies and processes to evaluate and manage exposures to operational risk, including risks arising from direct and indirect crypto-asset exposures and exposures to crypto-asset service providers
EU banks should expect their existing ESG and climate risk frameworks to come under closer prudential scrutiny, and EU banks developing digital-asset or tokenised-instrument businesses should expect the prudential and crypto-asset regimes to be read together, not in isolation.
A Narrow waiver for class 1 investment firms
Most undertakings authorised as credit institutions under the CRD regime are ‘traditional banks’ in the sense that they take deposits and provide credit on their own account. However, where a MiFID investment firm has consolidated assets over EUR 30 billion, CRD IV requires those firms to be re-authorised and supervised as a credit institution under CRD instead of MiFID.
CRD VI varies this obligation by introducing a waiver mechanism allowing competent authorities, following an EBA opinion, to exempt certain undertakings over the EUR 30 billion asset threshold that carry out specified MiFID dealing or underwriting activities from the requirement to be authorised as a credit institution. When making a decision on the waiver request, a national competent authority will take into account at least the following elements:
- where the undertaking is part of a group, the organisation structure of the group, its booking practices and the allocation of assets across the group entities;
- the nature, size and complexity of the activities carried out by the undertaking; and
- the importance of and the systemic risk posed by the activities carried out by the undertaking.
This is a welcome mechanism that offers firms whose balance sheet may be at risk of oscillating between MiFID and CRD IV thresholds to apply for a waiver from the CRD IV prudential requirements applying to them in-full should the firm go over the EUR 30 billion threshold.
Periodic penalty payments
CRD VI amends Article 65 of CRD IV which introduces new “periodic penalty payments” which is a recurring financial penalty designed to compel an institution back into compliance with an ongoing breach. Importantly, the updated Article 65 of CRD IV makes it clear that the imposition of periodic payment penalties does not prevent the supervisory authority from imposing a monetary fine in respect of the same breach.
The periodic payment penalties provides national competent authorities with a new enforcement tool, which heightens the risks and costs for EU banks associated with a prolonged, unresolved breach. Banks should factor the potential costs of such periodic payment penalties into their risk management and compliance frameworks, noting that such penalties may be in addition to other administrative penalties or measures for the same breach.
Looking ahead
The EBA has a pipeline of regulatory and implementing technical standards due in 2026 and early 2027 covering areas from merger and acquisition assessment methodology to conflicts-of-interest guidelines for supervisors. Matheson are tracking these closely and will issue further updates as they are published.
In the meantime, EU banks should not assume that CRD VI is only concerned with the authorisation of third-country lenders. In particular, CRD VI’s notification and prior approval rules for mergers, divisions, material asset transfers and material acquisitions is a near-term.
If you would like to discuss how CRD VI affects your institution’s governance, proposed deals or risk management framework, please contact the authors of this Insight, any member of our Financial Institutions Group, or your usual Matheson contact.
