EU Banking License in 2026: The Complete Credit Institution Guide

What an EU banking licence actually authorises

A credit institution licence, or banking licence, is the authorisation granted under Article 8 of Directive 2013/36/EU (CRD) and Regulation (EU) 575/2013 (CRR) that lets an entity take deposits from the public and grant credit for its own account. Everything else a bank does (payments, cards, FX, custody, investment services) can be done under lighter licences; only the combination of deposit-taking plus lending on own account is reserved to banks.

Within the Banking Union, banking authorisation follows a two-tier process. National competent authorities (NCAs) receive and assess the file. The European Central Bank, under the Single Supervisory Mechanism (SSM), makes the final decision on every new banking licence in the 21 Eurozone and close-cooperation countries. Outside the Eurozone, the NCA is the sole decision maker.

In practice, a banking charter is the heaviest instrument on the fintech shelf. Capital, governance, supervision and reporting burdens sit far above EMI, PI or MiCA CASP. The payoff is a unique combination of deposit funding, on-balance-sheet lending and the full product shelf.

Capital: the EUR 5 million floor and what it really means

CRD Article 12 sets the minimum initial capital of a credit institution at EUR 5 million. Several Member States have set higher national floors (Germany traditionally EUR 5 million but effectively higher for universal banks, Lithuania EUR 1 million for its specialised bank category, France EUR 5 million, Luxembourg EUR 8.7 million for certain profiles). EUR 5 million is the minimum, almost never the actual figure a supervisor expects.

Real capital is set by a three-step stack.

1. Pillar 1 - CRR minimum. Risk-weighted assets times 8% total capital ratio, of which 4.5% CET1, 6% Tier 1. Plus a capital conservation buffer of 2.5%, a countercyclical buffer (0-2.5%), systemic buffers and global or other systemically important institution (G-SII / O-SII) buffers. A realistic first-year running capital ratio for a new bank is 15 to 20% CET1.
2. Pillar 2 - SREP add-on. The supervisor reviews the bank's risk profile under the Supervisory Review and Evaluation Process and sets an individual add-on (P2R) that is binding, plus guidance (P2G) that is not binding but expected. P2R for new banks commonly adds 1.5 to 3% to the headline ratio.
3. CRR3 (Basel 3.5) output floor. In force from 1 January 2025 and phasing in until 2033, the output floor limits internal-model benefits to 72.5% of the standardised approach. New banks almost always start on standardised models, so the output floor is less of a shock for them than for legacy incumbents.

Most greenfield banks in the Eurozone start with between EUR 20 million and EUR 100 million of CET1 capital, plus a multi-year funding plan that raises additional Tier 1 and Tier 2 when loan books grow. EUR 5 million is enough to pass the door; it is not enough to run a bank.

The CRR/CRD framework in one page

European banking law sits on four layers that every applicant needs to know by name.

CRR3 entered into force on 9 July 2024 and applies from 1 January 2025, implementing the final Basel 3.5 rules on output floor, credit risk, market risk, operational risk and CVA. CRD6 entered into force on 9 July 2024, with transposition by 11 January 2027 and new licensing rules for core banking activities that explicitly capture third-country branches lending into the EU. Anyone designing a new bank should plan for CRD6 expectations, not CRD4 or CRD5 memory.

Realistic timelines, phased licences and mobilisation

Obtaining a banking licence is measured in years, not months. Credible 2026 benchmarks by jurisdiction:

• Germany (BaFin + ECB). 24 to 48 months for a universal bank licence. BaFin-led pre-assessment for 9 to 18 months, then ECB decision. Substance-heavy and documentation-heavy.
• France (ACPR + ECB). 24 to 36 months. ACPR runs a structured "Autorite de controle prudentiel" process; ECB involvement adds 3 to 6 months at the end.
• Ireland (Central Bank + ECB). 30 to 60 months. Very thorough, English, popular with post-Brexit EU HQs. Substance and governance expectations are extremely high.
• Netherlands (DNB + ECB). 24 to 36 months. English procedure, pragmatic, strong on risk and AML.
• Lithuania (Bank of Lithuania + ECB). 12 to 24 months for a specialised bank (EUR 1 million floor, no CRD full-product scope) and 18 to 36 months for a universal bank. Fastest in the Eurozone.
• Luxembourg (CSSF + ECB). 24 to 36 months. Strong for private-banking, custody and fund-servicing profiles.

The UK runs a separate regime outside CRD. The PRA/FCA offer a mobilisation route (authorisation with restrictions) that lets a new bank hold a licence with a capped deposit book and capped lending for up to 12 months while it builds out systems and team. The mobilisation route is credited with enabling most UK challenger banks (Starling, Monzo, Atom, Tandem) and has no exact equivalent in the EU, though Lithuania's specialised-bank regime is the closest functional analogue.

The authorisation file: what a bank application actually contains

The ECB's Guide to assessments of licence applications (2019, updated 2021) is the single best reference. The file runs to several thousand pages in every credible application.

1. Programme of operations (5-year business plan). Products, target markets, distribution channels, revenue projections, cost base, balance-sheet growth, funding plan. Three scenarios: base, adverse, stress.
2. Capital and funding plan. Initial capital, committed shareholder support, Tier 1 and Tier 2 issuance plan, deposit-gathering strategy, wholesale-funding assumptions, MREL pathway.
3. Governance and organisation. Board and committee structure, management body fit-and-proper, key function holders (CFO, CRO, CCO, Head of Internal Audit, MLRO), three-lines-of-defence, remuneration policy.
4. Risk management framework. Credit, market, liquidity, operational, conduct, reputational, ICT, outsourcing, concentration. Risk appetite statement, risk limits, escalation and reporting pipelines.
5. ICAAP and ILAAP. Internal Capital and Liquidity Adequacy Assessment Processes: self-assessed capital and liquidity needs, stress tests, projections. The backbone of SREP review.
6. ICT, cybersecurity and DORA. Architecture, data, cybersecurity, third-party register, incident response, resilience testing. DORA applies from 17 January 2025 and is already integrated into new-bank reviews.
7. Recovery and resolution plan. Recovery triggers, options, critical functions, resolvability considerations, MREL building blocks.
8. AML/CFT framework. Institutional risk assessment, policies, detection rules, sanctions and PEP screening, MLRO, staff training. Expected depth well above EMI or PI standard.
9. Accounting, audit and external reporting. IFRS or national GAAP choice, external auditor, FINREP/COREP reporting stack, supervisory data pipeline.

Supervisors expect the file to be internally consistent across all nine areas. Inconsistencies between the business plan and the capital plan, or between the risk appetite and the ICAAP, are the single most common cause of extended review.

Governance: fit-and-proper in the banking context

The ECB applies EBA guidelines on internal governance (EBA/GL/2021/05) and ECB supervisory expectations on top of national standards. The fit-and-proper bar is significantly higher than under PSD2 or MiCA.

• Management body. Collective suitability across strategy, risk, IT, compliance and banking-specific expertise. Minimum board sizes (7 to 10 members), independence thresholds, committee mandates (risk, audit, nomination, remuneration).
• Executive CVs. Each key function holder gets a detailed assessment. CFO and CRO must have proven banking experience; first-time banking hires are routinely rejected at CRO level.
• Shareholders and qualifying holdings. Every 10% shareholder is fit-and-proper tested. Complex holding structures, private-equity fund chains, SPV layers all unpacked to ultimate beneficial owner. Fund-owned banks face longer and more detailed assessment.
• Remuneration. CRD remuneration rules: bonus caps (100% of fixed, or 200% with shareholder vote), deferred variable pay, malus and clawback, gender-neutral policy.

Substance expectations are absolute. The bank's head office, executive management and critical functions must be in the home state. "Brass plate" banks do not pass SSM review.

Alternatives: when you don't need a full bank

Most fintechs that "want to be a bank" do not actually need a full CRD credit-institution licence. Map the product to the lightest sufficient regime.

The Lithuania specialised bank regime deserves a specific mention. Initial capital EUR 1 million, full deposit-guarantee coverage, CRD passport with scope restrictions (no investment services, limited derivatives), timeline 12 to 24 months. Twelve such banks have been licensed since 2017. For many digital-bank founders, this is the right starting point and they upgrade to full CRD later.

Ongoing supervision: what day-two life looks like

Getting the licence is less work than keeping it. Banks inside the SSM live under a tight supervisory calendar.

• Joint Supervisory Team (JST). A mixed ECB-plus-NCA team assigned to each bank. Weekly contact for significant banks, monthly for less-significant, plus ad-hoc.
• SREP cycle. Annual review of business model, governance, capital, liquidity. Produces P2R, P2G and a supervisory score. Score drives supervisory intensity and bonus caps.
• COREP and FINREP. Quarterly and monthly supervisory data reports on own funds, RWA, liquidity, large exposures, loans, income. Plus AnaCredit granular credit data.
• Stress tests. EU-wide every 2 years (EBA), national and internal ICAAP stress tests annually. Climate stress tests became permanent from 2024.
• DORA supervision. Mandatory ICT incident reporting within 4 hours, mandatory threat-led penetration tests, third-party register, oversight of critical ICT providers.
• Recovery and resolution exercises. Annual recovery plan update, participation in resolution colleges, MREL monitoring.
• AML supervision. Increasingly coordinated by AMLA (the new EU AML Authority, operational from 2026) on top of national AML supervisors.

Supervisory fees are material. ECB + NCA fees for a small significant bank run EUR 300,000 to EUR 2 million per year. For less-significant banks, national supervisory fees sit in the EUR 100,000 to EUR 500,000 range.

Popular EU jurisdictions for a new bank in 2026

Ship your digital bank with Crassula's core

A banking licence is the legal layer. The product layer is core banking: ledger, accounts, payments, cards, lending, treasury, risk, admin and customer app. Building all of that in-house takes 3 to 5 years and a team of 100. Crassula delivers it as a composable core so bank applicants can go from file to live product in 6 to 12 months post-authorisation.

We work alongside your legal and prudential counsel on the authorisation file. The same platform supports specialised banks, full banks, challenger banks and EMIs that plan to upgrade.

FAQ