ECB Banking Authorisation: How the SSM Licensing Procedure Works

The European Central Bank has been the sole gatekeeper for banking licences across the euro area since 4 November 2014, and in September 2026 it rewrote the manual for getting one. The revised Guide to licence applications, which replaces the 2019 edition, sets out how ECB banking authorisation works: who has to apply, how a file moves between a national supervisor and Frankfurt, and what the ECB tests before it lets a new bank open its doors.

Article 15 of the CRD requires a grant or refusal within six months of receipt of a complete application and, in any event, within twelve months of receipt of the application. Under EBA/GL/2021/12, the relevant first-year capital portion should generally be paid up before authorisation is granted; in jurisdictions where national law instead requires payment before commencement of activities, the authorisation should contain an express condition suspending its effects until payment.

The Guide reads the Single Supervisory Mechanism (SSM) framework, the CRD, the Capital Requirements Regulation (CRR) and the European Banking Authority’s assessment methodology together, explaining how the ECB and the national competent authorities (NCAs) apply them in practice, staying within the existing legal requirements rather than extending them.

Related reading: the ECB’s legal framework for banking supervision

What ECB banking authorisation covers, and who grants it

Article 4(1), point (a) of the SSM Regulation (Council Regulation (EU) No 1024/2013) makes the ECB exclusively competent to grant authorisation to take up the business of a credit institution. Article 6(4) and Article 14 of the same regulation extend that competence to every bank in the SSM, whether the ECB supervises it directly as a significant institution or an NCA supervises it as a less significant institution.

This is the point that is easy to get backwards. Every banking licence in the euro area, significant or less significant, is granted by the ECB, including for a small bank that will sit under national day-to-day supervision. The NCA runs the assessment on the ground and proposes a draft decision, but the binding decision to grant belongs to Frankfurt. The one asymmetry worth noting is that a licence can be refused at national level: under Article 14(2) of the SSM Regulation, where the NCA concludes the requirements cannot be met, it can issue a negative decision without the ECB signing off on it.

The ECB identifies four main assessment areas: the applicant credit institution’s capital and other regulatory requirements; its programme of activities, structural organisation and business plan; fit and proper assessments of its management body; and the suitability of its direct and indirect shareholders.

The September 2026 text is itself part of a wider clean-up. In June 2026 the ECB announced a review of around 130 supervisory publications, discontinuing roughly 40 as outdated and revising others for clarity and consistency. The Guide to licence applications was one of the documents revised, with the express aim of clarifying procedural matters and pointing readers to the EBA’s assessment methodology instead of restating it.

Key timing points in a licence application

Licensing runs as a sequence of dates that the applicant only partly controls. The points below are the ones worth pinning to the wall before anyone drafts a business plan.

• Decision deadline. Article 15 of the CRD requires a decision to grant or refuse within twelve months of the initial submission, and within six months of a complete application.
• Countdown start. Member States have transposed Article 15 differently. In some, the clock starts when the NCA receives the application even if it is incomplete; in others it starts only once the file is considered complete. The maximum period can be shorter than twelve months in some jurisdictions.
• Suspension. Depending on applicable national law, a request for missing information may suspend the applicable assessment period and postpone a procedural deadline; it does not displace Article 15 CRD’s requirement that a grant or refusal be made within twelve months of receipt of the application.
• Capital for year one. Under EBA/GL/2021/12, the relevant first-year capital portion should generally be paid up before authorisation; where national law instead requires payment before commencement of activities, the authorisation should contain an express suspensive condition until payment.
• Capital for years two and three. The capital covering the second and third years must come from funding sources assessed as promptly available at the time the licence is granted.
• Right to be heard. If the ECB intends to reject the application or attach conditions or obligations, the applicant has three working days to comment under Article 31(3) of the SSM Framework Regulation.

Inside the common procedure: pre-application, application, decision

Licensing runs as what the SSM framework calls a common procedure. Article 14(1) of the SSM Regulation makes the national supervisor of the country where the bank will be established the entry point for every application, regardless of whether the projected bank meets the significance criteria. The NCA and the ECB then work the file together, and the ECB takes the final decision. Where a non-euro Member State has entered close cooperation with the ECB, Article 7(4) reroutes the mechanics: the NCA issues the decision, but on the ECB’s instructions.

The Guide splits the journey into three phases. The pre-application phase is the informal one, before anything is formally filed. Supervisors use it to explain the process, to test whether a banking licence is even the right authorisation for what the applicant wants to do, and to raise early prudential concerns. The ECB treats this as good practice precisely because it cuts down the number of later information requests. Feedback given here does not bind the eventual decision, but it is the cheapest place to discover that the plan needs reworking.

The application phase begins when the file lands with the NCA, ideally through the SSM Portal where the Member State supports it. From that point the NCA and the ECB can request additional information and, depending on national law, a request may suspend the applicable assessment period. Such a suspension does not displace Article 15 CRD’s twelve-month outer limit from receipt of the application. An applicant can withdraw at any stage. If it does not, the phase ends either with an NCA rejection under national law or with an NCA draft proposal to the ECB to grant, on which the ECB then decides under Articles 73 to 79 of the SSM Framework Regulation.

One practical trap sits inside the synchronisation of parallel procedures. A licence rarely travels alone: passporting notifications, a significance assessment, approval or exemption of a financial holding company, and qualifying holding acquisitions can all be triggered at once. For an Article 8a applicant, cross-border authorisation and passporting arrangements should be coordinated with the competent authorities as the firm moves from the investment-firm framework to the credit-institution framework.

Who counts as a credit institution

Before any of the assessment happens, the ECB has to confirm that the applicant actually needs a banking licence at all. The test is the definition in Article 4(1), point (1) of the CRR, which now has two limbs. Limb (a) is the classic credit institution: an undertaking whose business consists of taking deposits or other repayable funds from the public and granting credits for its own account. Limb (b) captures Class 1 investment firms, which carry out dealing on own account or underwriting above certain quantitative thresholds and are not otherwise excluded.

For classic banks the two activities are cumulative. Both activities must be present for the limb (a) definition to be satisfied. The Guide allows some flexibility during the phase-in of activities, for instance across the first twelve months, but if a business plan never puts both activities on a regular footing after a reasonable ramp-up, the applicant is told to reconsider whether a banking licence is the right regime.

This is where the boundary with payment firms matters. Funds received for payment services or for issuing electronic money are explicitly not deposits, under Article 18(3) of the second Payment Services Directive and Article 6(3) of the E-Money Directive. An applicant that only provides those services is not a credit institution and should not be filing for a banking licence. That distinction is a live one for the many payment institutions, e-money institutions and crypto firms that already hold their own authorisations; our guide to prudential reporting for payment and e-money institutions sits on the other side of the same line.

The CRR does not define ‘deposit’ for the Article 4(1)(1)(a) credit-institution perimeter. The Deposit Guarantee Schemes Directive defines deposits for its own purposes, while EBA/GL/2021/12 sets out the factors competent authorities should assess for authorisation and expressly notes that DGSD exclusions from eligible deposits do not determine the licensing notion of a deposit.

When a licence application is triggered beyond a brand-new bank

Initial authorisations are the obvious case, but the Guide spends most of its scope section on the less obvious ones. A licence cannot be transferred from one entity to another, so a bank that moves its seat to another SSM country needs a fresh ECB licence under the law of the destination state, and the old one does not travel with it. A merger can require a new authorisation where it creates a new entity and, in an activity-by-activity regime, can require a licence extension where the surviving institution takes on activities not covered by its existing authorisation. Articles 27h to 27j of the CRD govern mergers and divisions; under Article 27i(3), the separate merger assessment is not carried out where the proposed operation requires an Article 8 authorisation or Article 21a approval.

Whether an existing bank needs a licence extension for an additional Annex I activity depends on the scope of its existing authorisation and the applicable national licensing regime. In an activity-by-activity regime, an extension is needed for an activity not already covered. Annex I now includes issuing electronic money, including electronic-money tokens, issuing asset-referenced tokens and providing crypto-asset services by reference to MiCAR. The applicable national authorisation regime must therefore be checked.

Class 1 investment firms within Article 4(1)(1)(b) CRR must submit an Article 8a CRD application when the relevant trigger is met. Article 8a(3a) also allows the competent authority, on the firm’s request and after obtaining an EBA opinion, to waive the requirement to obtain credit-institution authorisation, subject to the statutory criteria and three-year reassessment. If authorisation is granted and the firm also intends to take deposits or other repayable funds from the public and grant credit for its own account, the limb (a) perimeter and the applicable national authorisation scope must also be addressed. We cover the mechanics of that migration in our note on investment firms reclassified as credit institutions.

Resolution throws up its own variant. When activities pass to a bridge bank under Articles 40 and 41 of the Bank Recovery and Resolution Directive, the bridge bank needs its own licence because the failing entity’s authorisation cannot travel with the assets. Article 41(1) of the BRRD lets the ECB authorise a bridge bank without full CRD compliance for a short, defined period, at the resolution authority’s request.

Capital at authorisation: the twelve-month and thirty-six-month tests

Under EBA/GL/2021/12, supervisors estimate the risk-based and leverage-based own-funds requirements over the first three years, using the higher outcome from the base-case or severe-but-plausible stress scenario. They then compare that amount with initial capital plus expected cumulative losses over the first three years and select the higher of those two amounts.

The initial-capital floor is determined under Article 12 of the CRD and applicable national law. Article 12(1) sets EUR 5 million as the general minimum, but Article 12(4) allows Member States to authorise particular categories of credit institutions with initial capital below EUR 5 million, provided it is at least EUR 1 million and the required notifications are made. Article 93(1) of the CRR then prevents own funds from falling below the initial-capital amount required at authorisation.

Under EBA/GL/2021/12, the relevant first-year capital portion should generally be paid up before authorisation. Where national law instead requires payment before commencement of activities, the competent authority should include an express condition suspending the effects of the authorisation until payment. Supervisors also verify that the capital is separated from the owners’ assets and is fully, immediately and unrestrictedly available for the credit institution’s sole use.

For the second and third years the standard is “promptly available”. This is the phrase that decides whether a funding plan holds up. Future inflows whose value is uncertain when the licence is granted, such as a shareholder’s projected future profits, capital from a future initial public offering, market debt issuance, or the proceeds of selling volatile or illiquid assets, may fail the test. Signed capital-provision agreements with shareholders, or planned intragroup Additional Tier 1 or Tier 2 issuance where the parent has enough excess capital, can meet it. Capital that depends on an IPO that has not yet completed, or on profits the bank has not yet earned, may not satisfy the promptly-available standard. The ongoing capital-adequacy expectations the bank inherits afterwards are set out in the ECB’s ICAAP and ILAAP framework, which the programme of operations should already anticipate.

Fit and proper, and the shareholders behind the bank

Every member of the management body, in both its executive and its supervisory function, is assessed for fitness and propriety as part of the licence, under Article 13(1) of the CRD as transposed. The four-eyes principle in the same article means the application has to name at least two people who will effectively direct the business. The criteria are the ordinary fit and proper ones from Article 91 of the CRD: experience, reputation, conflicts of interest and independence of mind, time commitment, and the collective suitability of the board as a whole, read alongside the joint ESMA and EBA suitability guidelines and the ECB’s own fit and proper guide.

A point that saves a lot of anxiety later: the licence assessment of the board is a one-off. Once the initial decision is taken, later board appointments and reshuffles follow the ordinary fit and proper process, leaving the licence itself intact. The licence-stage assessment resurfaces only in narrow situations, for example a licence extension that brings in new board members or that changes the business model enough to put the board’s collective knowledge in question.

Shareholders are assessed in parallel. Before granting the licence, the competent authority looks at anyone who will hold a qualifying holding in the new bank, which the CRR defines in Article 4(1), point (36) as a direct or indirect holding of 10% or more of capital or voting rights, or one that allows significant influence over management. Both direct and indirect shareholders are in scope, so a holding structure that buries the ultimate owner two or three entities up does not put that owner beyond the assessment.

Where AML/CFT enters a prudential decision

Anti-money laundering sits outside the ECB’s own supervisory mandate, so the Guide keeps its AML/CFT considerations “from a prudential perspective”. That risk feeds the prudential judgments the ECB does own, chiefly governance and the suitability of shareholders, keeping the assessment within the ECB’s prudential competence.

The cooperation architecture behind that is now explicit. The ECB works with NCAs, national AML/CFT authorities and financial intelligence units under national arrangements, with other competent authorities under Article 56, point (g) and Article 117(5) of the CRD, and with the new Anti-Money Laundering Authority (AMLA) on the basis of a Memorandum of Understanding signed on 27 June 2025. The shareholder assessment carries a specific hook: under Article 23(1) of the CRD, competent authorities may object to a proposed acquirer situated in a high-risk third country with strategic AML/CFT deficiencies, or one subject to Union restrictive measures, where that affects the acquirer’s ability to run a compliant operation.

Conditions, obligations and the handover to ongoing supervision

A licence file that reveals shortcomings does not automatically fail. The Guide sets out a graded set of ancillary provisions the ECB can attach to a decision, and the differences between them are operationally real. A condition suspends the legal effectiveness of the authorisation until a specified event happens, so the bank cannot operate until it is met. An obligation deals with matters that arise after the licence is effective; breaching it does not undo the licence, but it can trigger enforcement measures or sanctions. A recommendation is not binding at all and can be attached even where every criterion is already met, as guidance for the road ahead. Applicants can also offer ex ante commitments, written undertakings agreed before the decision, which may then be reflected as agreed conditions or obligations.

Due process wraps the end of the procedure. Where the ECB intends to reject an application or impose conditions or obligations, the applicant is entitled to be heard, with three working days to comment under Article 31(3) of the SSM Framework Regulation, subject to the carve-outs for commitments the applicant has already made in writing. The applicant can also ask to see the ECB’s file, under Article 22(2) of the SSM Regulation and Article 32 of the SSM Framework Regulation, within the limits that protect other parties’ business secrets and confidential information.

The licence is the start of the relationship with the supervisor. The moment it is granted, the bank moves into ongoing supervision, where the same governance, capital and risk expectations are tested continuously as the bank operates, having been tested once at the gate, and where obligations attached at authorisation are monitored on an ongoing basis.

Frequently Asked Questions

If our bank will be a less significant institution, do we apply to our national regulator or to the ECB?

You file with your national competent authority, which is the entry point for every application under Article 14(1) of the SSM Regulation, but the licence itself is granted by the ECB. The NCA assesses the file and proposes a draft decision; the binding grant is the ECB’s, for less significant and significant institutions alike. The NCA can, however, reject the application on its own under Article 14(2) without the ECB deciding.

We only plan to take deposits, not to lend. Do we still need a banking licence?

For a classic credit institution the two activities are cumulative: taking deposits or other repayable funds from the public and granting credits for your own account. A plan that never establishes both on a regular basis after a reasonable ramp-up is a signal that a banking licence may not be the right regime. The Guide asks applicants to reconsider the application in that situation.

Can we count a planned capital raise or projected profits toward the capital we need at authorisation?

Under EBA/GL/2021/12, the relevant first-year capital portion should generally be paid up before authorisation, subject to the jurisdictional exception where national law requires payment before commencement and the authorisation is suspended until payment. For years two and three, supervisors assess the capital implementation plan, including the type and timing of funding sources and whether their terms make the capital promptly available.

How long can the ECB take, and can the clock be stopped?

Article 15 of the CRD requires a grant or refusal within twelve months of receipt of the application and, where the application is incomplete, within six months of receipt of the complete information. Depending on national law, requests for further information may suspend an applicable assessment period, but they do not displace the twelve-month outer limit.

Do we need a new licence decision every time we appoint a director after authorisation?

The licence assessment of the management body is a one-off, taken at authorisation. Later appointments or board changes follow the ordinary fit and proper process, leaving the licence intact. The licence-stage board assessment returns only in narrow cases, such as a licence extension that brings in new members or materially changes the business model.

Do crypto-asset or e-money token activities now sit inside a banking licence?

They appear in the CRD’s Annex I list of activities subject to mutual recognition, which now names issuing electronic money tokens, issuing asset-referenced tokens and crypto-asset services, each defined by reference to MiCAR. A credit institution’s authorisation can therefore cover them, and in an activity-by-activity state an existing bank needs a licence extension to take them up. It does not follow that every token issuer must become a bank; firms authorised under MiCAR or the e-money regime operate under those frameworks.

What happens if the ECB finds problems but still wants to grant the licence?

It can attach ancillary provisions. A condition holds the authorisation’s effectiveness until something specified is done; an obligation binds the bank after the licence takes effect and can lead to enforcement if breached; a recommendation is non-binding guidance. Applicants can also offer written ex ante commitments before the decision, which may be reflected as agreed conditions or obligations.

Our firm is a Class 1 investment firm that has just crossed the thresholds. What do we file?

An Article 8a CRD application uses Commission Delegated Regulation (EU) 2022/2579. Article 1(1) of that Regulation expressly requires the application also to comply with Articles 3 to 10 of Commission Delegated Regulation (EU) 2022/2580, so the Article 8a RTS does not replace the standard licensing information requirements. Article 8a(3a) CRD also permits a request for a waiver from the requirement to obtain credit-institution authorisation, subject to the statutory conditions.

Related Articles

• ECB Legal Framework for Banking Supervision Volume 3: The consolidated SSM legal instruments, including the delegation decisions the ECB uses for authorisation, own funds and fit and proper decisions.
• EBA RTS on Investment Firms Reclassified as Credit Institutions: When a Class 1 investment firm must apply for a banking licence under Article 8a of the CRD, and the information it has to provide.
• CRD VI Luxembourg Transposition Law 2026: How Luxembourg has transposed the CRD authorisation and governance requirements the ECB applies in a licensing decision.
• ECB ICAAP and ILAAP Package Clarification 2026: The internal capital and liquidity adequacy expectations a newly licensed bank inherits in ongoing supervision.
• ECB On-Site Inspections and Timely Remediation 2026: What ongoing supervision looks like once the licence is granted and obligations attached at authorisation are monitored.
• CSSF Prudential Reporting for PI, EMI and CASP: The reporting regime for payment and e-money institutions, which sit on the other side of the deposit boundary from credit institutions.

Key Takeaways

• For banks established in euro-area Member States, the NCA is the entry point and the ECB takes the authorisation decision regardless of significance. For a non-euro Member State participating through close cooperation, the national authority adopts the relevant decision in accordance with the ECB’s instructions under the close-cooperation framework.
• Article 15 of the CRD requires a grant or refusal within twelve months of receipt of the application and within six months of receipt of complete information; national-law suspension of an assessment period does not displace the twelve-month outer limit.
• Under EBA/GL/2021/12, the relevant first-year capital portion should generally be paid up before authorisation, subject to the jurisdictional exception where national law requires payment before commencement and the authorisation is suspended until payment; funding for years two and three is assessed through the capital implementation plan for prompt availability.
• Initial capital cannot fall below the applicable amount set under Article 12 of the CRD and national law: EUR 5 million is the general minimum under Article 12(1), while Article 12(4) permits particular categories to be authorised with initial capital of at least EUR 1 million; Article 93(1) of the CRR preserves the applicable authorisation amount as an ongoing own-funds floor.
• A classic credit institution must both take deposits and grant credits; payment institutions and e-money institutions are not credit institutions because their client funds are not deposits.
• The board’s fit and proper assessment is a one-off at authorisation; later appointments run through ordinary fit and proper, not a new licence decision.
• Shareholders holding 10% or more of capital or voting rights, directly or indirectly, are assessed before the licence is granted, and AML/CFT risk can support an objection to a third-country acquirer.
• Crypto-asset services, e-money tokens and asset-referenced tokens now appear in the CRD Annex I list, so taking them up in an activity-by-activity state means a licence extension.

Sources and References

• ECB, Guide to licence applications (September 2026)
• ECB, “ECB streamlines supervisory guidance to improve clarity and transparency” (26 June 2026)
• Council Regulation (EU) No 1024/2013 (SSM Regulation)
• Regulation (EU) No 468/2014 (SSM Framework Regulation, ECB/2014/17)
• Directive 2013/36/EU (Capital Requirements Directive)
• Regulation (EU) No 575/2013 (Capital Requirements Regulation)
• Commission Delegated Regulation (EU) 2022/2580 (RTS on the information for authorisation as a credit institution)
• Commission Implementing Regulation (EU) 2022/2581 (ITS on licensing information)
• Commission Delegated Regulation (EU) 2022/2579 (RTS on authorisation of investment firms as credit institutions, Article 8a CRD)
• EBA Guidelines on a common assessment methodology for granting authorisation as a credit institution (EBA/GL/2021/12)
• Directive 2014/59/EU (Bank Recovery and Resolution Directive)
• Directive (EU) 2015/2366 (Payment Services Directive 2, PSD2)
• Directive 2009/110/EC (Electronic Money Directive, EMD)
• Directive 2014/49/EU (Deposit Guarantee Schemes Directive, DGSD)

Before you file with the NCA

The Guide does not change the legal requirements. Applications enter through the NCA and are assessed against the ECB’s four main licensing areas. Article 15 CRD sets the six-month complete-application deadline and the twelve-month outer limit. Capital payment must follow the applicable national-law route and the EBA capital methodology, including the capital implementation plan for years two and three.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.