The review generally found increased transparency and consistency of the information required in the authorisation process. However, it also identified significant divergences in competent authorities’ assessment and the degree of scrutiny of applications. The review, therefore, sets out a series of measures to address such divergencies, to level out the supervisory playing field and to mitigate against ‘forum shopping’.

The review examined the implementation of the EBA Guidelines in this area. Overall, the EBA found that competent authorities have largely or fully applied the Guidelines, thus contributing to consistency and transparency in the authorisation process. However, the peer review identified divergent practices in relation to the assessment of business plans, applicants’ governance arrangements and internal control mechanisms. It also highlighted differences in applicants’ compliance with PSD2 requirements on ‘local substance’, i.e. the need for payment institutions to have their head office in the Member State where they are seeking authorisation and to conduct part of their activities there.

The report also shows that the average duration of the overall authorisation process varies significantly across competent authorities, ranging from 4 to 20 months or more. The quality of applications and applicants’ timeliness in addressing issues identified appear to be key reasons for delay, but different timelines set out in national laws and different procedural approaches in the acceptance and assessment of applications also cause variations in duration.

The EBA adopted follow-up measures for competent authorities, which it will review in two years’ time and some best practices, which might benefit competent authorities. These follow-up measures include targeted measures for specific competent authorities to strengthen consistency and effectiveness, as well as follow-up measures for all competent authorities, in particular to:

review their authorisation resources and processes to ensure that they remain adequate to scrutinise applications within a reasonable timeframe;

ensure that applicants have a ‘three lines of defence’ model that includes the functions of risk management, compliance and internal audit, where the nature, scale and complexity of their activities makes this appropriate; and

ensure that applicants are effectively managed and controlled from the jurisdiction in which they seek authorisation.

The review also concluded that any future review of the Guidelines should provide more detailed guidance on how the proportionality principle should be applied in assessing the suitability of shareholders with qualifying holdings. Finally, the review recommends to the European Commission to clarify, as part of its ongoing PSD2 review process, the delineation between the different categories of payment services and e-money issuance, the applicable governance arrangements for institutions, including the criteria that competent authorities should use in assessing the suitability of management, and what having sufficient local substance requires.

Legal basis and background

Article 30 of the EBA Regulation requires the EBA to periodically conduct peer reviews of some or all of the activities of competent authorities within its remit, to further strengthen consistency and effectiveness in supervisory outcomes. Peer reviews identify follow-up measures to achieve this, together with best practices seen in competent authorities. After two years, the EBA is required to assess the adequacy and effectiveness of actions taken by competent authorities in response to the follow-up measures.

The peer review has been performed by an ad hoc Peer Review Committee made up of EBA and competent authorities’ staff in accordance with the EBA peer review work plan for 2022-2023 and following the process in Article 30 of the EBA Regulation and EBA peer review methodology.

The exercise covered competent authorities from all EU Member States and from two European Economic Area (EEA) States and assessed competent authorities’ supervisory practices in the authorisation of payment institutions and e-money institutions over a three-year period from 1 January 2019 to 31 December 2021.