24. Decision of the competent authority

Competent authorities should take a decision based on the assessment of individual and collective suitability of members of the management body and the assessment of heads of internal control functions and the CFO, where they are not members of the management body, within the maximum period referred to in paragraph 179 or, if the period has been suspended, within a maximum period of six months after the start of that period.

In the cases referred to in paragraph 181, in accordance with the second subparagraph of Article 15 of Directive 2013/36/EU, a decision to grant or refuse authorisation must, in any event, be taken within 12 months of the receipt of the application.

Where an institution fails to provide sufficient information regarding the suitability of an assessed individual to the competent authority, the latter should either inform the institution that the member cannot be a member of the management body or a key function holder because it has not been sufficiently proven that the person is suitable, or decide negatively.

Where the outcome of the assessment of suitability by the competent authority concludes that it is not sufficiently proven that the assessed person is suitable, the competent authority should object to or not approve the appointment of that person, unless the identified shortcomings are remediable and can be overcome by other measures taken by the institution.

Competent authorities should inform institutions of at least a negative decision taken as soon as possible. Where provided by national law or defined by the competent authority as part of their supervisory processes, a positive decision may be deemed to be taken by silence, when the maximum period for the assessment, as referred to in paragraph 179, is completed and the competent authority has not taken a negative decision.

The competent authority, considering the measures already taken by the institution, should take appropriate measures to address the identified shortcomings and set a timeline for the implementation of these measures. Such measures should include as appropriate one or more of the following measures:

• a. requiring the institution to organise specific training for the members of the management body individually or collectively;
• b. requiring the institution to change the division of tasks amongst the members of the management body;
• c. requiring the institution to refuse the proposed member or to replace certain members;
• d. requiring the institution to change the composition of the management body to ensure the individual and collective suitability of the management body;
• e. removing the member from the management body;
• f. where appropriate, imposing administrative penalties or other administrative measures (e.g. setting out specific obligations, recommendations or conditions), including ultimately withdrawing the institution’s authorisation.

The measures referred to in (a) and (c) should also be applicable in the context of the suitability assessments of the heads of internal control functions and the CFO, where they are not part of the management body, of significant CRD institutions.

Where members of the management body do not fulfil the requirements set out in Article 91(1) of Directive 2013/36/EU, competent authorities have the power to remove such members from the management body. The competent authorities should in particular verify whether the requirements set out in Article 91(1) of Directive 2013/36/EU and as further specified in these Guidelines are still fulfilled where they have reasonable grounds to suspect that money laundering or terrorist financing is being or has been committed or attempted, or there is increased risk thereof in connection with that institution.