Bank Authorization, Ownership and Regulatory Perimeter

Introduction and context

A bank is not merely a company that accepts deposits and makes loans. It is an institution entrusted with other people’s money, connected to payment systems, and capable of transmitting financial distress across households, firms and markets. For that reason, entry into banking is normally controlled through authorization, continuing supervision and powers to intervene when risks become unacceptable.

This chapter examines how regulators determine who may conduct banking business, who may own or control a bank, which activities a bank may undertake, and how supervision extends across branches, subsidiaries, holding companies, banking groups and non-bank financial intermediaries. The central idea is the regulatory perimeter: the boundary between activities and entities subject to a particular framework of authorization and supervision and those outside it.

Regulatory systems differ by country. Terms such as “bank,” “credit institution,” “financial holding company,” “money services business” and “shadow banking” may have different legal meanings. Accordingly, this chapter presents general principles consistent with internationally recognized supervisory practice, including the Basel Core Principles, while recognizing that the applicable statute and regulator always control.

Learning objectives

After studying this chapter, students should be able to:

1. Explain why banking authorization is required and distinguish authorization from prudential supervision.
2. Apply fit-and-proper standards to significant owners, directors and senior managers.
3. Analyze ownership, control and change-of-control transactions.
4. Distinguish branches, subsidiaries, representative offices and parent holding companies.
5. Identify permissible activities and regulatory-perimeter risks involving non-bank financial intermediaries.
6. Evaluate a proposed banking structure using governance, capital, risk and supervisory criteria.

1. The logic of authorization

1.1 Why entry is restricted

A banking licence performs several public functions:

• Credibility: it signals that the institution meets minimum legal, financial and governance standards.
• Depositor protection: it reduces the probability that depositors deal with an unsafe institution.
• System integrity: it helps protect payment, settlement and clearing systems.
• Market discipline: it identifies institutions that may access deposit insurance or central-bank facilities, where legally eligible.
• Accountability: it gives the supervisor powers to inspect, direct, sanction and, if necessary, close the institution.

Authorization is not a guarantee that a bank will never fail. It is an ex ante risk-screening process followed by continuing supervision. A licence may be withdrawn or restricted if the bank no longer satisfies legal or prudential requirements.

1.2 Banking business and unauthorized activity

The activities requiring a licence vary by jurisdiction, but commonly include accepting deposits or other repayable funds from the public, granting credit as a business, providing payment services, or using the word “bank” in a manner likely to mislead the public. Some systems separate commercial banking, investment banking, deposit-taking, payment institutions and electronic-money institutions; others authorize broader universal banks.

A central legal distinction is between:

• Taking repayable funds from the public, which creates a direct protection concern;
• Borrowing from sophisticated counterparties, which may be regulated differently; and
• Providing credit with the firm’s own capital, which may be lending but not deposit-taking.

The distinction is functional rather than merely linguistic. An entity cannot avoid licensing by calling deposits “investment advances,” “membership contributions” or “prepayments” if customers bear substantially the same repayment risk.

1.3 Typical authorization criteria

Although application forms differ, regulators commonly assess:

1. legal form and proposed name;
2. business plan and target market;
3. ownership and sources of capital;
4. financial projections and capital adequacy;
5. governance arrangements;
6. risk-management, compliance and internal-audit systems;
7. information and technology security;
8. recovery and orderly-exit planning;
9. group structure and related-party exposures; and
10. the competence and integrity of owners and key personnel.

A regulator may also consider whether the proposal is compatible with public interest, financial stability, competition policy and the supervisory capacity of the host jurisdiction.

2. Authorization as a staged decision

Authorization is best understood as a sequence rather than a single form submission.

Stage 1: preliminary engagement

The promoter explains the proposed institution, ownership, business model and timetable. Early engagement can identify whether the proposal is legally eligible and whether the regulator has concerns about complexity, capital or controlling persons.

Stage 2: formal application and due diligence

The applicant supplies constitutional documents, ownership charts, financial statements, business projections, policies, biographies, criminal-record information and evidence of capital. Regulators verify beneficial ownership and the origin of funds. Incomplete or opaque ownership is a major warning sign.

Stage 3: assessment and conditions

The supervisor tests whether the proposal is viable and governable. Authorization may be conditional—for example, requiring the appointment of specified executives, completion of systems testing, restrictions on activities or a minimum opening capital level.

Stage 4: pre-opening and continuing supervision

Before launch, the regulator may inspect premises, technology, cybersecurity controls, books and records, complaints procedures and staffing. After authorization, the bank must submit returns, maintain prudential ratios, notify material changes and permit supervisory access.

A licence therefore creates continuing obligations. It is not a permanent property right detached from conduct.

3. Fit-and-proper requirements

3.1 Meaning and purpose

“Fit and proper” is a regulatory standard applied to persons whose decisions can materially affect a financial institution. It normally covers:

• Honesty, integrity and reputation: whether the person has a history of fraud, serious misconduct, deception, market abuse or regulatory breaches;
• Competence and capability: whether the person possesses suitable knowledge, experience and judgment; and
• Financial soundness: whether personal financial circumstances create unacceptable incentives, conflicts or vulnerability to improper influence.

The standard applies differently according to role. A non-executive director may need governance and financial-literacy competence, while a chief risk officer requires demonstrable risk expertise. A significant shareholder must be sufficiently reputable and financially sound to support the institution without exerting improper pressure.

3.2 Assessment is ongoing

Fit-and-proper assessment is not completed at appointment. Banks should conduct periodic declarations, conflict-of-interest reviews, training assessments and event-driven reassessments. A director’s later criminal conviction, undisclosed conflict or material misrepresentation may require notification and regulatory action.

3.3 Collective suitability

Individual competence is insufficient if the board as a whole lacks expertise in credit, markets, technology, accounting, compliance and consumer protection. Supervisors therefore assess board composition, independence, challenge, succession and committee effectiveness.

3.4 Practical evidence

Evidence may include curricula vitae, references, regulatory histories, litigation records, insolvency records, conflict declarations and interviews. Applicants must disclose adverse information honestly. Concealment often creates a more serious supervisory concern than the original event.

4. Ownership, control and beneficial ownership

4.1 Direct and indirect ownership

Legal ownership may be held by a person, company, trust or investment vehicle. The regulator is concerned with the beneficial owner—the person who ultimately benefits from or controls the interest—even where shares are held through several entities.

A useful ownership map identifies:

• each legal entity in the chain;
• voting and economic interests;
• shareholder agreements and concert-party arrangements;
• rights to appoint directors;
• veto rights and management agreements; and
• the ultimate natural persons exercising control.

Control can exist without majority ownership. It may arise from board-appointment rights, dispersed ownership, contractual influence or the ability to direct strategic decisions.

4.2 Sources and quality of capital

Regulators distinguish between capital that is permanent, loss-absorbing and freely available, and funding that creates repayment obligations or hidden leverage. They examine whether proposed capital derives from legitimate sources and whether the investor can provide support during stress without compromising independence.

The source-of-funds inquiry also supports anti-money-laundering objectives. A bank should not become a vehicle for laundering proceeds, evading sanctions or concealing politically exposed persons’ interests.

4.3 Ownership limits and concentration

Some jurisdictions impose limits on ownership by individuals, non-financial companies, foreign investors or a single shareholder. These limits seek to prevent the bank from becoming a private treasury of a dominant owner. Exceptions may exist for regulated financial groups, subject to approval and consolidated supervision.

Concentrated ownership is not automatically unsafe, and dispersed ownership is not automatically safe. The relevant questions are whether control is transparent, accountable, financially supported and subject to effective governance.

5. Change of control

A person proposing to acquire a significant interest usually must obtain prior regulatory approval. The trigger may be based on voting rights, ownership percentage, appointment rights or a broader legal definition of control.

The assessment commonly covers:

• reputation and fit-and-proper status of the acquirer;
• financial capacity and funding sources;
• the acquirer’s business plan;
• the effect on governance and competition;
• the combined group’s ability to support the bank;
• risks from excessive leverage or interconnectedness; and
• the quality of supervision in the acquirer’s home jurisdiction.

A transaction completed without required approval can lead to penalties, voting restrictions, forced divestment or action against the bank’s licence. Banks must therefore maintain reliable shareholder registers and systems for identifying indirect ownership.

6. Corporate structures and the regulatory perimeter

6.1 Branches

A branch is legally part of the same bank rather than a separately incorporated company. Its assets and liabilities generally belong to the parent bank. Advantages include operational integration and lower duplication; risks include contagion, complex resolution and uncertainty over which jurisdiction protects local creditors.

A host regulator typically examines the home supervisor’s quality, the parent’s financial strength, local liquidity, books and records, and cooperation arrangements. A branch does not create a separate capital cushion in the way a subsidiary may.

6.2 Subsidiaries

A subsidiary is a separately incorporated entity controlled by a parent. It normally has its own capital, board and legal obligations. A subsidiary can localize risks and simplify domestic resolution, but it may also create intragroup transactions, duplicated governance and opportunities for regulatory arbitrage.

A bank subsidiary may conduct banking business; a non-bank subsidiary may provide leasing, insurance, securities dealing, payments or technology services, subject to relevant permissions. The parent remains responsible for effective group governance and must not use the subsidiary to evade restrictions applying to the bank.

6.3 Representative offices

A representative office generally performs limited liaison, research or marketing functions and does not accept deposits or conduct full banking business. Its restricted status must be clear to customers. Misrepresenting a representative office as a bank is a perimeter breach.

6.4 Holding companies and banking groups

A bank may sit beneath a financial holding company or within a mixed financial group. Supervisors use consolidated supervision to assess risks across the group, including capital, large exposures, liquidity, governance, related parties, risk concentrations and intra-group contagion.

Consolidation is not simply adding every balance-sheet item. Supervisors must eliminate intra-group exposures where appropriate, recognize minority interests consistently and apply prudential rules to the risks that can reach the banking entity. The exact method is determined by applicable law and supervisory standards.

Figure: An illustrative banking group in which different entities may have separate licences but remain relevant to consolidated supervision.

7. Permissible activities and regulatory arbitrage

A bank’s licence usually specifies or implies permitted activities. Common banking activities include deposit-taking, lending, payment services, trade finance, foreign exchange and investment services. Activities may be subject to limits, conduct rules, capital charges or separate authorization.

The separation principle restricts activities that could expose insured deposits or the payment system to excessive market, insurance, commercial or speculative risk. Other systems permit universal banking but control risk through capital, liquidity, governance and large-exposure rules.

Regulatory arbitrage occurs when an institution structures a transaction or activity to obtain the economic result of a regulated service while formally avoiding the applicable rule. Examples include:

• a technology platform performing payment functions without the required authorization;
• a lender funding itself through instruments that function like deposits;
• transferring risky assets to an affiliate while retaining the economic exposure; or
• booking transactions in a lightly regulated jurisdiction while managing them elsewhere.

Sound supervision follows substance, risk and control rather than labels alone. Banks should maintain a regulatory inventory mapping each product, legal entity, customer activity and applicable permission.

8. Non-bank financial intermediaries

Non-bank financial intermediaries (NBFIs) include finance companies, leasing firms, insurers, securities firms, money-market funds, payment institutions, e-money issuers, peer-to-peer platforms and some fintech lenders. They can improve access, competition and innovation, but may also create bank-like risks without being subject to identical safeguards.

Important perimeter questions include:

1. Does the entity take funds repayable by the public?
2. Does it perform a critical payment, clearing or custody function?
3. Does it provide maturity or liquidity transformation?
4. Is it leveraged, interconnected or systemically important?
5. Does a bank sponsor, guarantee or distribute its products?
6. Who bears losses if the intermediary fails?

The aim is not to place every financial activity under bank regulation. Proportionate regulation recognizes differences in risk while preventing material risks from escaping oversight merely because they arise outside a bank.

9. Governance and compliance implementation

A bank should implement authorization and perimeter obligations through a documented control framework. Core practices include:

• maintaining a legal-entity and licence register;
• assigning accountable owners for each regulatory permission;
• obtaining legal and compliance review before launching products;
• conducting beneficial-ownership and change-in-control monitoring;
• screening directors, senior managers and significant owners;
• documenting related-party and intragroup transactions;
• escalating breaches to senior management and the board;
• retaining evidence of regulatory filings and approvals; and
• testing whether outsourced providers perform regulated functions.

The board should receive clear information about licensing conditions, material ownership changes, regulatory examinations and emerging perimeter risks. Compliance is not simply a legal department’s task: business, risk, technology, finance, internal audit and senior management all have responsibilities.

Technology and AI

Digital banking and artificial intelligence complicate perimeter analysis. A bank may outsource customer onboarding, credit scoring, cloud infrastructure or payment processing, but outsourcing does not transfer regulatory accountability. The bank must understand the service, control access to data, monitor model risk, ensure operational resilience and retain audit and supervisory access.

An AI provider that only supplies software may not be a financial institution. However, if it receives customer funds, makes regulated decisions on behalf of a bank, or performs a payment or credit function, additional licensing, outsourcing and consumer-protection questions arise. The legal analysis must focus on the function actually performed.

10. Illustrative case: Northbridge Financial Group

This is a fictional teaching case.

Background

Northbridge Payments Ltd operates a mobile wallet. It is owned by Northbridge Holdings, whose principal shareholder is a wealthy entrepreneur. Northbridge proposes to acquire 40% of Community Bank and to transfer the wallet business into a new bank subsidiary. The group also plans a leasing company and an AI-based credit-scoring affiliate.

Problem

The proposal creates four questions: whether the acquisition requires prior change-of-control approval; whether the principal shareholder is fit and financially capable; whether the wallet is a payment institution or a deposit-taking business; and whether the holding company’s structure permits effective consolidated supervision.

Analysis

The regulator first maps the ultimate beneficial owner, voting agreements and funding sources. It then assesses the shareholder’s reputation, financial capacity and history with other regulated firms. The acquisition cannot be treated as a routine investment merely because the shares are purchased through a holding company.

The wallet’s customer balances are examined functionally. If customers have a contractual claim repayable on demand and the funds are used in a manner characteristic of deposits, the bank-licensing question becomes significant. If the product is legally structured as safeguarded electronic money, a different authorization and safeguarding regime may apply. The label “wallet” is not decisive.

The proposed leasing and AI affiliates are assessed for licensing, outsourcing, data protection, operational resilience and conflicts of interest. The regulator requires group-wide reporting, limits on intragroup exposures, independent compliance and risk functions, and clear recovery arrangements. It may require the group to simplify the structure if supervision would otherwise be obstructed.

Approach and outcome

Northbridge submits a revised application containing a transparent ownership chart, audited source-of-funds evidence, independent directors, a group risk policy and a product-permission matrix. The wallet is placed in a separately authorized entity with safeguarded customer funds. The AI affiliate becomes a controlled service provider rather than an unlicensed lender. Approval is granted subject to conditions on ownership reporting, outsourcing, data governance and consolidated supervision.

Learning points

1. Control may exist without complete legal ownership.
2. Product labels do not determine regulatory treatment.
3. A group structure must be assessable as a whole.
4. Outsourcing and technology do not remove the bank’s accountability.
5. Authorization is a continuing relationship, not a one-time administrative event.

11. Challenges and limitations

Regulatory perimeter design involves unavoidable trade-offs. Excessively strict entry requirements may reduce competition, financial inclusion and innovation. Weak requirements may encourage unsafe institutions and regulatory migration. Multiple regulators can create gaps or duplicated reporting. Cross-border groups may exploit differences between home and host rules.

Supervisors also face information problems. Beneficial ownership can be concealed through layered entities; new digital products may evolve faster than legislation; and non-bank risks may become visible only during stress. Effective responses include information-sharing agreements, technology-neutral rules, supervisory colleges, thematic reviews, public registers where legally permitted, and proportionate regulation based on function and risk.

Ethically, authorization decisions must be consistent, evidence-based and free from political favoritism. Regulators should protect confidential information while explaining decisions sufficiently to support accountability. Banks must treat licensing as a public-trust responsibility rather than an obstacle to commercial growth.

Best-practice checklist

Before launching or acquiring a regulated business, an institution should ask:

• What exact activity is being performed, and which licence covers it?
• Who ultimately owns and controls each entity?
• Are all owners, directors and senior managers fit and proper?
• Are capital and funding sources lawful, transparent and sustainable?
• Does the group structure permit consolidated supervision?
• Are branches, subsidiaries and affiliates subject to appropriate local oversight?
• Could the activity create deposit-like, payment, liquidity or systemic risk?
• Are outsourcing, cybersecurity, data and AI risks controlled?
• Are change-of-control and material-change approvals required?
• Can the institution demonstrate compliance through reliable records?

Chapter Summary

Bank authorization protects depositors, payment systems and financial stability by controlling entry and imposing continuing obligations. Licensing typically examines the business model, capital, governance, systems, ownership and the competence and integrity of key persons. Fit-and-proper assessment applies to significant owners, directors and senior managers and must be updated when circumstances change.

Ownership analysis goes beyond registered shares to beneficial ownership and actual control. Acquisitions and other changes of control commonly require prior approval. Branches remain legally part of the parent, while subsidiaries are separately incorporated and capitalized; both raise different supervisory and resolution issues. Holding companies and banking groups require consolidated supervision so that risks cannot be hidden in affiliates.

The regulatory perimeter is functional and risk-based. Banks and non-bank intermediaries must be assessed according to what they actually do, not merely what they call themselves. Digital platforms, outsourcing and AI create new perimeter questions but do not eliminate the bank’s accountability. Effective compliance combines transparent ownership, sound governance, product authorization, group-wide controls, supervisory cooperation and ethical public-trust responsibilities.

Key Terms

Authorization: Official permission to conduct a regulated financial activity.

Beneficial owner: The natural person who ultimately owns or controls an interest.

Banking group: A bank and entities connected through ownership or control.

Branch: An establishment that is legally part of the parent bank.

Change of control: A transaction or arrangement that gives a person significant influence over a bank.

Consolidated supervision: Supervisory assessment of a financial group as a whole.

Fit and proper: The required standard of integrity, competence, reputation and financial soundness.

Holding company: A company whose role includes owning or controlling other companies.

Intragroup exposure: A financial claim, guarantee or obligation between entities in the same group.

Licence condition: A restriction or requirement attached to regulatory authorization.

Non-bank financial intermediary: A financial intermediary that is not licensed as a bank.

Permissible activity: An activity a regulated entity is legally authorized to undertake.

Regulatory arbitrage: Structuring activity to avoid a rule while achieving a similar economic result.

Regulatory perimeter: The boundary of activities and entities subject to a regulatory regime.

Representative office: A limited office that generally cannot conduct full banking business.

Significant owner: A person whose ownership or influence reaches a legally important threshold.

Source of funds: Evidence explaining where investment capital originated.

Subsidiary: A separately incorporated entity controlled by a parent.

Ultimate control: The practical ability to direct decisions, whether or not majority shares are held.

Review Questions

Short Answer Questions

1. Why is banking entry generally subject to authorization?
2. What three broad qualities are assessed under the fit-and-proper standard?
3. How does a branch differ legally from a subsidiary?
4. What is meant by beneficial ownership?
5. Why is consolidated supervision important for banking groups?

Long Answer Questions

1. Explain the stages of a bank authorization process and the continuing obligations created by a licence.
2. Discuss how regulators assess a proposed significant shareholder and a change-of-control transaction.
3. Compare branches, subsidiaries and representative offices in terms of legal identity, capital and supervisory concerns.
4. Explain how regulatory arbitrage can arise through non-bank financial intermediaries and digital platforms.
5. Evaluate the governance and compliance controls a banking group should establish before launching a new product.

Analytical / Application Questions

1. A fintech wallet allows customers to place funds that can be withdrawn on demand, while the operator lends part of the balance to consumers. Identify the principal regulatory-perimeter questions and explain what evidence a regulator would require.
2. An investor acquires 30% of a bank through three companies owned by relatives and obtains the right to appoint four of seven directors. Analyze whether this may constitute control and identify the approvals and disclosures likely to be required.
3. A bank proposes to outsource credit decisions to an AI affiliate located abroad. Design a supervisory and compliance assessment covering licensing, outsourcing, data, model risk, governance and consolidated group oversight.

Multiple Choice Questions with Answers

Question 1

What is the primary purpose of bank authorization?

A. To guarantee that every bank earns a profit

B. To control entry and protect depositors and financial stability

C. To eliminate competition among banks

D. To replace all ongoing supervision

Correct Answer: B. To control entry and protect depositors and financial stability

Question 2

Which person is most directly subject to a fit-and-proper assessment?

A. A bank’s ordinary retail customer

B. A bank’s office cleaner

C. A proposed significant shareholder

D. A supplier with no access to bank systems

Correct Answer: C. A proposed significant shareholder

Question 3

What does beneficial ownership identify?

A. The person who ultimately owns or controls an interest

B. Only the company listed in a share register

C. The bank’s external auditor

D. The institution’s largest depositor

Correct Answer: A. The person who ultimately owns or controls an interest

Question 4

Which statement about a branch is generally correct?

A. It is always a separately incorporated company

B. It is legally part of the parent bank

C. It cannot be supervised by a host regulator

D. It must have independent shareholders

Correct Answer: B. It is legally part of the parent bank

Question 5

What is the purpose of consolidated supervision?

A. To assess only a bank’s retail branches

B. To exclude non-bank affiliates from review

C. To assess risks across a connected financial group

D. To permit unlimited intragroup lending

Correct Answer: C. To assess risks across a connected financial group

Question 6

Why may a change-of-control transaction require prior approval?

A. Because control can affect governance, risk and supervisory expectations

B. Because all share transfers are criminal offences

C. Because banks cannot have shareholders

D. Because approval guarantees the purchaser’s return

Correct Answer: A. Because control can affect governance, risk and supervisory expectations

Question 7

Which factor is most relevant to identifying regulatory arbitrage?

A. The color of a firm’s branding

B. The economic function and risk of the activity

C. The number of employees in the marketing department

D. The age of the company website

Correct Answer: B. The economic function and risk of the activity

Question 8

A representative office generally performs which function?

A. Full deposit-taking and lending

B. Unlimited securities underwriting

C. Limited liaison, research or marketing

D. Central-bank monetary policy

Correct Answer: C. Limited liaison, research or marketing

Question 9

What is a key principle of outsourcing by a bank?

A. Outsourcing transfers all regulatory accountability to the vendor

B. The bank remains accountable for outsourced activities

C. Outsourced activities never require risk controls

D. The vendor automatically receives a banking licence

Correct Answer: B. The bank remains accountable for outsourced activities

Question 10

Which issue is especially relevant when assessing the source of capital for a bank acquisition?

A. Whether the funds are lawful, transparent and financially sustainable

B. Whether the investor prefers electronic documents

C. Whether the target bank has a popular logo

D. Whether the investor has used the same broker before

Correct Answer: A. Whether the funds are lawful, transparent and financially sustainable