Governance and fit-and-proper evidence

Three tests inside one sentence

Repute, competence and time are assessed separately, and a candidate can pass two and fail the third. Article 68(1) singles out convictions relating to money laundering or terrorist financing, and any other offences affecting good repute, so the repute test is not confined to financial crime, and a spent matter in an unrelated field is still a matter to disclose and explain rather than omit.

Competence is tested individually and collectively. The collective limb is the one worth designing for: it asks whether the body as a whole covers what the business actually does. A firm whose entire risk profile is custody and key management, staffed by a board of capital markets veterans with no operational technology depth, has a collective gap that no individual CV closes.

Time commitment must be demonstrated, not asserted. The practical form of that demonstration is a schedule of other mandates and the hours each consumes. A director who cannot produce one is not obviously going to satisfy the test.

Qualifying holders

The test reaches indirect holders, which means the ownership chain has to be traced to the natural persons at its end. Two consequences follow that applicants routinely discover late. The first is that nominee and trustee arrangements do not terminate the enquiry; they extend it. The second is that source-of-funds evidence is about those people, not about the applicant company's bank balance.

What the authority can do short of refusing

This is a useful thing to know when a shareholder is the problem. The authority is not confined to a binary grant-or-refuse on that basis: it may apply for judicial orders, impose penalties on directors and those responsible for management, or suspend the voting rights attaching to the holding. A structure that isolates a problematic holder's influence is therefore a real remedy rather than a cosmetic one, but it has to be genuine, because the test is the influence actually exercised, not the shareholding on paper.

Policies are required to be effective, not merely adopted

Article 68(4) requires providers to adopt policies and procedures "sufficiently effective to ensure compliance with this Regulation". The adjective is the whole point. A complete set of policies bought as a pack and never implemented satisfies the completeness check under Article 63(2) and fails the substantive assessment, because it is evidence of purchasing rather than of control.