4.1 Common assessment methodology

Competent authorities should ensure that for the purposes of granting an authorisation as a credit institution, as defined in Article 4(1) of CRR, they apply the common assessment methodology (‘CAM’) set out in these Guidelines.

The CAM lays down the criteria and methods according to which competent authorities should assess the common requirements for granting authorisation as a credit institution set out in Articles 10 to 14 of Directive 2013/36/EU.

For the purposes of these Guidelines, references to risk also include ML/TF risk. Competent authorities should therefore comprehensively assess AML/CFT-related aspects for the purposes of granting the authorisation. To this end, competent authorities should cooperate with the relevant AML/CFT supervisor and other relevant public bodies as appropriate in compliance with Article 117(5) of Directive 2013/36/EU¹³ .

¹³ In particular the EBA Guidelines on cooperation on and information exchange between prudential supervisors, AML/CFT supervisors and financial intelligence units under Directive 2013/36/EU. The Consultation Paper, EBA/CP/2021/21 of 27 May 2021, is available at https://www.eba.europa.eu/eba-consults-new-guidelines-cooperation-and-information-exchange-area-anti-money-laundering-and

In order to ensure that the assessment for granting the authorisation is based on reliable information, competent authorities should review the information and documents submitted with the application pursuant to the RTS on information for authorisation , in light of the requirements of truthfulness, clarity, accuracy, up-to-dateness and completeness, and with a view to ensuring the sound and prudent management of the institution. Pursuant to Article 10(2) of the RTS on information for authorisation , competent authorities may also require the applicant to provide supplemental information or additional explanations.

The CAM is technology-neutral and innovation-friendly, therefore it covers applicant credit institutions with all business models, both traditional and innovative business models and/or delivery mechanisms and, at the same time, does not impose requirements to use specific technologies or adopt certain structures. Therefore, it does not hinder the emergence and scaling up of new technologies and innovative business models. Accordingly, competent authorities should not prefer or prevent the adoption of a specific technology, nor should they prefer or prejudice a specific business model or service in the context of the assessment of the application. This is without prejudice to the need to ensure that the business model or the delivery mechanism cannot pose an obstacle to the competent authorities’ effective supervision.

In order to ensure a level playing field across the EU, competent authorities’ assessment should only be technical, reflect prudential regulation and be in accordance with Article 11 of Directive 2013/36/EU.

• i. Proportionality

Competent authorities should perform the assessment for granting the authorisation in accordance with the principle of proportionality as specified in these Guidelines, with a view to ensuring that the assessment is consistent with the individual risk profile and business model of the applicant credit institution, so that the objectives of the regulatory requirements are effectively achieved.

For this purpose competent authorities should take into account the following criteria:

• a) the expected size of the balance sheet of the applicant credit institution and its subsidiaries within the scope of prudential consolidation, as applicable;
• b) the expected geographical presence of the applicant credit institution and the size of its operations in each jurisdiction;
• c) the legal form of the applicant credit institution, including whether the credit institution is part of a group;
• d) whether the institution is listed or not;
• e) the type of planned activities and services performed by the applicant credit institution (e.g. see also Annex 1 to Directive 2013/36/EU and Annex 1 to Directive 2014/65/EU);
• f) the business model (including its innovative character, uniqueness or complexity) and strategy, as well as the expected level of risk stemming from the implementation and execution; the nature and complexity of the targeted business activities;
• g) the credit institution’s organisational structure;
• h) the envisaged risk strategy, risk appetite and risk profile of the applicant credit institution;
• i) the ownership and funding structure of the applicant credit institution;
• j) the type of clients (e.g. retail, corporate, institutional, small businesses, public entities) and the complexity of the envisaged products or contracts;
• k) the envisaged outsourced functions and distribution channels;
• l) the existing and/or planned information technology (IT) systems, including continuity systems and outsourcing functions in this area;
• m) whether the applicant credit institution belongs to a group which is subject to the consolidated supervision of the competent authority;
• n) whether the applicant credit institution submits an application for specific activities only, or an existing credit institution applies for an extension of the scope of the authorisation whenever the authorisation has exclusively been granted for the exercise of specific activities;
• o) the consistency with the type and breadth of information required pursuant to the RTS on information for authorisation .

In the case of paragraph 18, letter m), and in line with Article 10(1) of the RTS on information for authorisation , the intensity of the assessment should take into account the competent authority’s direct knowledge – based on information available to it – of the business model, risk profile and current prudential, financial, business and operational conditions of the applicant credit institution or group.

In the case of paragraph 18, letter n), provided the submitted extension does not materially alter the nature and risk profile of the credit institution, the competent authorities’ assessment should be limited in scope and focus on the impact of the new additional activities on the overall business model and on the capacity to comply with prudential requirements, in particular on the sound and prudent management of the credit institution (including, in particular, the profitability of the new business lines and the overall sustainability of the business plan, the suitability of the members of the management body in its management or supervisory function, the internal control framework and IT systems). It should also take into account the competent authority’s direct knowledge of the applicant credit institution’s business model, risk profile and current prudential, financial, business and operational conditions.

The application of the principle of proportionality by the competent authorities can never amount to exempting the applicant credit institution from the fulfilment of any mandatory requirements for granting the authorisation.