Bank Licensing, Ownership and Permissible Activities

Introduction and context

A bank is not merely another commercial company. It receives repayable funds from the public, operates within the payments system, creates credit through intermediation, and may transmit monetary-policy decisions to the wider economy. Its failure can therefore harm depositors, payment counterparties, fiscal authorities and financial stability. Bank licensing is the legal and supervisory mechanism through which the state decides who may conduct banking business, under what conditions, and subject to which continuing controls.

This chapter examines licensing criteria, legal forms, ownership and control, fit-and-proper standards, corporate structures, universal and specialised banking, branching, subsidiaries, and regulatory-perimeter questions. The analysis uses internationally recognised principles, particularly those associated with the Basel Committee on Banking Supervision, while recognising that the precise legal rules differ across jurisdictions. Students should therefore distinguish between general supervisory principles and the binding legislation of a particular country.

Learning objectives

By the end of this chapter, students should be able to:

1. Explain why banking requires a special licence and identify the usual stages of authorisation.
2. Evaluate legal-form, capital, governance, business-plan and risk-management requirements.
3. Analyse ownership, control, beneficial ownership and fit-and-proper standards.
4. Distinguish universal, commercial, investment, development, digital and other specialised banking models.
5. Assess regulatory implications of branches, subsidiaries, financial groups and outsourcing arrangements.
6. Apply regulatory-perimeter concepts to practical licensing and corporate-structure decisions.
7. Critically evaluate supervisory discretion, proportionality, competition and financial-inclusion considerations.

1. Why banking is a licensed activity

A banking licence performs three connected functions. First, it protects the public by restricting deposit-taking to institutions capable of meeting prudential, governance and conduct standards. Second, it supports financial stability by enabling supervisors to assess institutions before they become systemically important. Third, it protects the integrity of the financial system through requirements concerning anti-money laundering and counter-terrorist financing (AML/CFT), sanctions compliance, consumer protection and operational resilience.

The legal definition of “bank” varies. It may be based on deposit-taking, credit intermediation, the use of the word “bank”, access to payment systems, or a combination of these elements. A firm that lends only its own capital may not be a bank, whereas a firm that accepts repayable funds from the public normally enters the regulated perimeter. The distinction matters because unauthorised deposit-taking can expose households to loss and can create an unstable form of maturity transformation.

A licence is not a guarantee that a bank will never fail. It is an ex ante assessment and an ongoing supervisory relationship. Authorisation must therefore be understood as the beginning, rather than the end, of regulation. A bank remains subject to reporting, inspections, capital and liquidity requirements, governance rules, resolution planning, and possible enforcement or licence withdrawal.

2. The licensing architecture

Although institutional arrangements differ, licensing commonly involves a central bank, prudential regulator, financial-services authority, deposit insurer, competition authority, or a combination of these bodies. Some jurisdictions use a single authority; others separate prudential supervision from conduct supervision. Where a proposed bank belongs to a financial conglomerate, the supervisor may also consult foreign supervisors and authorities responsible for company law, tax, competition and national security.

A typical licensing process includes the following stages:

1. Pre-application engagement. The promoter discusses the business model, ownership structure and intended activities with the regulator.
2. Formal application. The applicant submits constitutional documents, financial projections, governance arrangements, policies, evidence of capital and information about controllers.
3. Assessment and verification. The authority tests the feasibility of the plan, checks sources of funds, interviews proposed directors and senior managers, and seeks information from other regulators.
4. Decision. The licence may be granted, refused, or granted subject to conditions, such as limits on products, geography, ownership or risk exposure.
5. Pre-opening verification. The regulator confirms that systems, staff, premises, cybersecurity, internal controls and operational arrangements are ready.
6. Ongoing supervision. The institution is monitored through returns, risk-based inspections, meetings, stress testing and enforcement powers.

A useful conceptual distinction is between entry criteria and continuing requirements. Entry criteria establish whether the applicant is suitable to begin banking. Continuing requirements establish whether it remains suitable after authorisation. Weak performance after licensing may lead to a remediation plan, business restriction, change of management, merger, resolution or withdrawal of the licence.

Figure: Bank licensing is a cycle linking entry assessment with continuing supervision.

3. Core licensing criteria

3.1 Legal form and constitutional capacity

The applicant must generally be incorporated under an approved legal form, often a company limited by shares. The legal form should permit transparent ownership, audited accounts, effective board accountability and, where necessary, conversion into a resolution structure. Mutual, cooperative, state-owned and Islamic banking forms may be permitted, but each requires rules suited to its ownership rights and governance risks.

The constitutional documents should define the institution’s objects, share classes, voting rights, transfer restrictions and governance organs. A company whose constitution permits uncontrolled non-banking activities may be unsuitable unless the regulator can impose effective limits.

3.2 Capital and financial resources

Applicants must demonstrate initial paid-up capital and reliable access to additional financial resources. The regulator examines not only the amount but also the quality, permanence and source of capital. Capital supplied through opaque loans, circular transactions, undocumented gifts or funds linked to illicit activity is unacceptable. The applicant must also show credible projections for operating losses during the start-up period and for meeting prudential requirements as the balance sheet expands.

Minimum statutory capital is only a floor. A business model involving wholesale funding, complex trading, rapid digital acquisition or concentrated lending may require substantially more capital than the legal minimum. Supervisors commonly apply proportionality: small institutions may have simpler systems, but they cannot be exempted from fundamental prudential outcomes.

3.3 Business plan and viability

A credible business plan identifies target customers, products, pricing, distribution channels, funding sources, expected profitability, stress scenarios and exit assumptions. It should explain why the proposed bank is needed and how it will compete without relying on unrealistic growth or regulatory arbitrage.

Supervisors should challenge projections that assume perpetual low funding costs, immediate profitability, zero operational losses or unlimited access to parent-company support. Important questions include: What happens if loan growth is half the forecast? How will liquidity be maintained during a deposit run? Can the bank serve customers fairly? Is the business dependent on a single technology vendor or related party?

3.4 Governance and internal control

The proposed board must collectively possess competence in banking, risk, accounting, law, technology and the local market. Board independence is especially important where a dominant shareholder is also a major borrower or supplier. Core control functions—risk management, compliance, internal audit and finance—must have sufficient authority, resources and access to the board.

The three-lines model is useful, although it is not a substitute for judgement. The first line owns risks, the second line provides independent challenge and oversight, and the third line—internal audit—provides independent assurance. The board remains responsible for the institution even when activities are outsourced.

3.5 Risk management, AML/CFT and technology

The applicant must establish systems for credit, market, liquidity, operational, cyber, model, conduct and strategic risks. AML/CFT arrangements should identify customers, beneficial owners and unusual transactions, and should support suspicious-transaction reporting. Technology-dependent banks must demonstrate secure architecture, access controls, incident response, data governance, backup arrangements and recovery capabilities.

Digital distribution does not remove licensing obligations. A mobile application may be a delivery channel for a licensed bank, an agent arrangement, or a separate regulated payment service. The legal classification depends on the substance of the activity, not its branding.

4. Ownership, control and fit-and-proper standards

4.1 Ownership transparency

Supervisors need to know who ultimately owns and controls a bank. Legal ownership may be distributed among companies, trusts, nominees or family members while effective control rests with one person. The relevant concept is therefore beneficial ownership: the natural person or persons who ultimately own, control or benefit from the entity.

Ownership approval commonly applies not only at initial licensing but also to later acquisitions, transfers, mergers and increases in voting rights. Thresholds vary, but regulators often require prior approval for significant holdings and notification of smaller changes. “Acting in concert” provisions prevent investors from evading approval by splitting a coordinated holding among nominally independent parties.

4.2 Fit and proper assessment

Fit-and-proper assessment usually considers:

• honesty, integrity and reputation;
• competence, experience and professional qualifications;
• financial soundness;
• time commitment and independence;
• conflicts of interest;
• past regulatory, criminal, insolvency or litigation history; and
• capacity to understand the institution’s risks.

The test applies to directors, senior managers, key function holders and significant shareholders, although the precise scope is jurisdiction-specific. It is not simply a background check. A technically capable executive may be unsuitable if incentives, conflicts or behaviour undermine prudent management.

A regulator should use evidence proportionately and allow procedural fairness, but it need not wait for a criminal conviction where credible evidence demonstrates dishonesty or serious risk. Continuing fitness is essential: a person who was suitable at authorisation may later become unsuitable through misconduct, incapacity or financial distress.

4.3 Ownership limits and related parties

Some jurisdictions limit foreign ownership, state ownership, cross-ownership among banks, or ownership by non-financial commercial groups. Such limits may protect against concentration, contagion and conflicts, but they can also reduce investment and competition. A sophisticated framework may permit ownership by a well-supervised financial holding company while prohibiting uncontrolled conglomerates.

Related-party rules are central. A controlling shareholder should not be able to use the bank as a source of cheap finance for private businesses. Controls commonly include exposure limits, arm’s-length terms, board approval, disclosure, independent review and restrictions on connected lending. The risk is not merely credit loss: related-party transactions can compromise the bank’s independence and distort allocation of capital.

5. Corporate structures and the regulatory perimeter

A bank may operate as a standalone company, a subsidiary of a financial holding company, a branch of a foreign bank, or part of a group containing insurance, securities, payments, technology and commercial entities. Structure affects supervision, legal responsibility, capital mobility, resolution and customer protection.

A bank subsidiary is a locally incorporated legal person. It normally has its own capital, board and licence, although it may rely on a parent for technology, funding or branding. A branch is an extension of the foreign bank rather than a separate legal person. The parent is generally responsible for the branch, but host authorities may have less control over capital located abroad. A branch may therefore be efficient for cross-border wholesale banking, while a subsidiary may offer stronger local ring-fencing and depositor protection.

The regulatory perimeter should follow economically significant functions. If a group places customer funds in an unlicensed affiliate, uses a technology company to perform critical banking operations, or shifts risk to an unregulated entity, formal legal separation should not defeat supervisory scrutiny. This is sometimes called a “same activity, same risk, same regulation” principle, though its implementation must recognise differences in legal form and risk.

Subsidiaries, outsourcing and financial groups

A bank may establish subsidiaries for securities, asset management, leasing, insurance, payments or technology services, subject to authorisation and group rules. The benefits include specialisation and access to expertise; the risks include contagion, conflicts, double gearing of capital, intra-group funding and supervisory blind spots.

Outsourcing is not a transfer of accountability. Contracts should define service levels, audit access, data location, security controls, subcontracting, business continuity, termination and regulator access. Critical third-party providers can create systemic concentration: several banks may depend on one cloud platform, payment switch or identity provider. Supervisors increasingly demand mapping of important services and credible exit strategies.

6. Universal and specialised banking

A universal bank may offer a broad range of banking and, in some systems, securities, insurance or payment services under one group. Advantages include diversification, one-stop service, economies of scope and cross-selling. Risks include complexity, conflicts between commercial and investment activities, opaque internal transfers and the possibility that losses in one business contaminate deposit-taking.

A specialised bank concentrates on a defined function or customer group, such as retail deposits, mortgage lending, agricultural finance, development finance, Islamic finance, savings, payments or investment banking. Specialisation may improve expertise and policy targeting, but it may also increase concentration risk and dependence on a narrow funding or asset class.

The universal–specialised distinction is not binary. A jurisdiction may permit a universal banking group while placing activities in separate subsidiaries, imposing capital and large-exposure limits, or restricting proprietary trading. The appropriate model depends on supervisory capacity, market structure, resolution arrangements and the quality of disclosure.

7. Branching, agents and geographic expansion

Branching policy balances competition and access against supervisory capacity and operational risk. A bank may need approval or notification before opening, relocating or closing branches. Supervisors assess security, cash management, staffing, accessibility, consumer treatment and the effect on underserved communities.

Agent banking can extend services through merchants or other intermediaries. The bank remains responsible for customer identification, transaction monitoring, safeguarding of funds, complaints and agent conduct. Clear customer disclosure is necessary so that customers understand whether they are dealing with a bank, a payment institution or an agent.

Cross-border branching raises home-host supervisory questions. The home supervisor assesses the parent’s consolidated condition; the host supervisor protects local depositors and financial stability. Effective cooperation requires information sharing, supervisory colleges, crisis protocols and clarity about deposit insurance and resolution. A host authority may require local incorporation where it cannot obtain adequate information or assurance from the home jurisdiction.

8. Regulatory perimeter and unlicensed competition

Perimeter problems arise when firms perform bank-like activities without a bank licence, or when licensed banks use affiliates to avoid restrictions. Examples include accepting repayable public funds through digital wallets, offering guaranteed returns through investment platforms, or using marketplace structures that obscure who bears credit risk.

Regulators should apply a functional analysis:

1. What economic activity is being performed?
2. Whose money is at risk?
3. Is there maturity transformation or leverage?
4. Is the public relying on a promise of repayment?
5. Who controls customer assets and data?
6. Could failure disrupt payments or confidence?

Possible responses include licensing, registration, conduct rules, limits on marketing, activity restrictions, consolidated supervision, or enforcement against unauthorised business. Excessively broad perimeters may suppress innovation; excessively narrow ones invite regulatory arbitrage. Regulatory sandboxes can help test new models, but they should not become a permanent exemption from prudential protection.

9. Applied case: Northstar Digital Bank (illustrative)

Background

Northstar, a technology company, proposes a digital bank owned by a holding company. It plans to take retail deposits through an application, originate small loans using automated credit scoring, outsource cloud infrastructure to a global provider, and offer investment products through a sister company. The founder will hold 18% directly and control a further 22% through two investment entities.

Problem

The regulator must decide whether to grant a licence and, if so, under what conditions. Concerns include beneficial ownership, automated lending, related-party transactions, outsourcing, the sister company’s investment products and the adequacy of the initial capital plan.

Analysis

The founder may be a controller despite holding less than a majority of legal shares because of coordinated voting and effective influence. The regulator should require a complete ownership map and declarations from all persons acting in concert. It should assess the founder’s financial history, competence and conflicts.

Northstar’s plan requires a credible liquidity model, not merely projected loan profitability. Automated scoring must be explainable enough to support governance, validation, complaint handling and fair treatment. The bank must monitor discrimination, data quality and model drift. The cloud contract must provide audit and regulator access, security standards, incident notification and a tested exit plan.

The sister investment company should be separately authorised where required. Marketing must distinguish deposits from investment products, and cross-selling must not imply that investment products receive deposit insurance. Related-party exposures, shared staff and common branding should be controlled and disclosed.

Approach and outcome

The regulator grants conditional approval. Conditions include a limit on initial product scope, independent directors, pre-approval of changes in significant ownership, enhanced capital during the growth phase, independent validation of the credit model, restrictions on lending to connected parties, a segregated customer interface for investments, and a tested cloud-continuity plan. Expansion is permitted only after the bank demonstrates stable operations and effective controls.

Learning points

The case illustrates that licensing is an integrated assessment of ownership, governance, technology, conduct and prudential capacity. A promising business model cannot compensate for opaque control or weak operational resilience. It also demonstrates that a digital bank is not a lower-risk bank: technology changes the form of risk rather than eliminating it.

10. Governance, ethics and contemporary developments

Licensing decisions involve public power and must be transparent, reasoned and subject to appropriate review. Regulators should avoid favouritism, manage conflicts of interest and publish clear criteria. Applicants should not treat authorisation as a lobbying exercise; they should provide complete, accurate and timely information.

Financial inclusion is a legitimate policy objective, but it does not justify unsafe banking. Proportionate regulation can reduce unnecessary barriers for community and digital institutions while preserving minimum standards for capital, governance, AML/CFT and customer protection. Competition policy is similarly important: ownership approval should prevent unsafe concentration without protecting inefficient incumbents.

Contemporary supervisory challenges include artificial intelligence in credit underwriting, biometric identification, open banking, embedded finance, crypto-asset interfaces, cloud concentration and climate-related financial risk. AI may improve access and efficiency, but licensing assessments should examine training data, explainability, human oversight, bias, privacy and accountability. Open banking can increase competition while creating third-party operational and consent risks. Embedded finance may place banking services inside a non-bank platform, making responsibility and disclosure especially important.

Best practice for applicants is to maintain a clear ownership chart, evidence source of funds, appoint a credible board, challenge optimistic forecasts, map critical services, test severe scenarios, establish independent control functions and engage openly with the regulator. Best practice for supervisors is to use risk-based proportionality, assess groups on a consolidated basis, cooperate across borders, monitor perimeter developments and communicate decisions consistently.

Chapter Summary

Bank licensing protects depositors, financial stability, payment integrity and market confidence. It is an entry decision followed by continuing supervision. Core criteria include legal capacity, reliable capital, a viable business plan, competent governance, effective risk management, AML/CFT controls, operational resilience and fair customer treatment.

Ownership assessment focuses on transparency, beneficial ownership, significant influence, source of funds and related-party risk. Fit-and-proper standards cover integrity, competence, financial soundness, independence and continuing suitability. Corporate form matters because branches, subsidiaries and holding-company structures distribute capital, responsibility and supervisory authority differently.

Universal banks offer diversification but create complexity and contagion risks; specialised banks offer expertise but may face concentration. Branches, agents, outsourcing and digital channels expand access while creating home-host, operational and accountability issues. The regulatory perimeter should follow economic substance and should address bank-like activities conducted through affiliates or technology platforms. Effective regulation balances safety, competition, innovation and inclusion through transparent, proportionate and risk-based supervision.

Key Terms

Bank licence: Legal authorisation to conduct specified banking activities.

Beneficial owner: Natural person who ultimately owns, controls or benefits from an entity.

Branch: Office of a bank that is not a separate legal person from its parent.

Capital: Financial resources available to absorb losses and support continued operation.

Consolidated supervision: Supervision of a banking group as a whole, including relevant subsidiaries.

Controller: Person able to exercise significant influence over a bank’s decisions.

Fit and proper: Standard assessing integrity, competence, experience, financial soundness and suitability.

Financial holding company: Parent company whose principal purpose is owning financial institutions.

Licensing perimeter: Boundary identifying activities and entities subject to financial regulation.

Material outsourcing: Delegation of an important function to an external provider.

Prudential supervision: Oversight directed at safety, soundness and risk containment.

Related party: Person or entity connected to the bank through ownership, control or close relationship.

Significant shareholder: Holder whose ownership or voting rights reach a legally important threshold.

Specialised bank: Bank restricted or focused on particular products, customers or functions.

Universal bank: Bank or banking group permitted to conduct a broad range of financial activities.

Regulatory arbitrage: Structuring activities to obtain the economic benefits of regulation without equivalent regulatory obligations.

Resolution: Managed process for dealing with a failing bank while protecting critical functions.

Review Questions

Short Answer Questions

1. Why is deposit-taking generally subject to licensing?
2. Distinguish a branch from a subsidiary.
3. What is meant by beneficial ownership?
4. Identify four elements commonly examined in a fit-and-proper assessment.
5. Why does outsourcing not remove a bank’s regulatory accountability?

Long Answer Questions

1. Explain the principal stages of the bank-licensing process and discuss why authorisation is the beginning of, rather than the end of, supervision.
2. Critically evaluate the advantages and risks of universal banking compared with specialised banking.
3. Discuss how ownership limits, related-party rules and consolidated supervision can reduce group-level risk.
4. Analyse the prudential and conduct issues raised by digital banks and automated credit scoring.
5. Explain how home and host supervisors should cooperate in the supervision of a foreign bank branch.

Analytical / Application Questions

1. A proposed bank is funded by a wealthy shareholder whose money passes through several offshore companies. Design a regulatory investigation addressing ownership, source of funds and control.
2. A bank plans to move its core banking system to a cloud provider also used by most competitors. Assess the benefits, risks and supervisory conditions that should apply.
3. A non-bank platform accepts customer funds, promises repayment on demand and uses the funds to make loans. Apply the functional regulatory-perimeter analysis and recommend an appropriate regulatory response.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the purpose of a bank licence?

A. To guarantee that the bank will never fail

B. To authorise banking activity after assessing safety, governance and public-interest risks

C. To exempt the bank from company law

D. To replace the bank’s internal audit function

Correct Answer: B. To authorise banking activity after assessing safety, governance and public-interest risks

Question 2

Which person is most clearly a beneficial owner?

A. An external auditor with no shares

B. A branch manager with delegated authority

C. A natural person who ultimately controls a chain of holding companies owning the bank

D. A customer with a savings account

Correct Answer: C. A natural person who ultimately controls a chain of holding companies owning the bank

Question 3

Which feature most directly distinguishes a branch from a subsidiary?

A. A branch is always unregulated

B. A subsidiary cannot conduct banking business

C. A branch is generally not a separate legal person from its foreign parent

D. A subsidiary has no capital requirements

Correct Answer: C. A branch is generally not a separate legal person from its foreign parent

Question 4

Which is normally part of a fit-and-proper assessment?

A. The director’s preferred advertising style

B. Integrity, competence and financial soundness

C. The number of products the director personally buys

D. The bank’s office furniture

Correct Answer: B. Integrity, competence and financial soundness

Question 5

Why are related-party lending controls important?

A. They ensure all loans are interest-free

B. They prevent shareholders from using the bank for unfair or excessive connected financing

C. They eliminate all credit risk

D. They allow directors to approve their own loans without review

Correct Answer: B. They prevent shareholders from using the bank for unfair or excessive connected financing

Question 6

A bank outsources its critical payment system. Which statement is correct?

A. The bank has no further responsibility for the system

B. The outsourcing automatically cancels the bank’s licence

C. The bank remains accountable and should ensure audit, security, continuity and regulator access

D. Only the technology vendor must comply with AML rules

Correct Answer: C. The bank remains accountable and should ensure audit, security, continuity and regulator access

Question 7

What is a principal advantage of universal banking?

A. It eliminates conflicts of interest

B. It may provide diversification and economies of scope

C. It removes the need for consolidated supervision

D. It guarantees stable profits

Correct Answer: B. It may provide diversification and economies of scope

Question 8

Which question best applies a functional regulatory-perimeter analysis?

A. What colour is the firm’s logo?

B. Does the activity involve public funds, repayment promises, leverage or maturity transformation?

C. How old is the chief executive?

D. Is the firm’s office located in a city centre?

Correct Answer: B. Does the activity involve public funds, repayment promises, leverage or maturity transformation?

Question 9

A digital bank’s credit model produces different approval rates for groups with similar risk profiles. What is the most relevant supervisory concern?

A. Branch decoration

B. Potential model bias and weak fair-treatment controls

C. Foreign-exchange settlement only

D. The legal definition of a subsidiary only

Correct Answer: B. Potential model bias and weak fair-treatment controls

Question 10

Which statement best reflects continuing fitness and propriety?

A. Suitability is assessed only once, on the licensing date

B. A person may become unsuitable later through misconduct or financial distress

C. Only shareholders can be assessed

D. Professional qualifications are irrelevant after appointment

Correct Answer: B. A person may become unsuitable later through misconduct or financial distress