Fact sheet on the assessment of key function holders at banks and (mixed) financial holding companies

The CRD6 provisions concerning the fit-and-proper assessment framework of key function holders have been implemented in the Financial Supervision Act (Wet op het financieel toezicht – Wft) and the Decree on Prudential Rules for Financial Undertakings (Besluit prudentiële regels Wft – Bpr) The new rules entered into force on 22 September 2026.

Who are key function holders?

Section 1:1 of the Wft sets out, by reference to the definition provided in Article 3(1)(9a) of the CRD, who are to be regarded as a key function holders. They are the persons who have significant influence over the direction of a bank, a financial holding company or a mixed financial holding company but are not members of the management body, including the heads of internal control functions and the chief financial officer, if they are not members of the management body. For banks, this definition replaces the former national ‘second tier’ insofar as it relates to fitness and propriety or their assessment.

Internal assessment by banks and (mixed) financial holding companies

Pursuant to Section 3:9b(1) of the Wft, banks must ensure that key function holders are suitable for their roles and that their integrity is beyond doubt. This also applies to approved (mixed) financial holding companies as referred to in Section 3:280a of the Wft, as Section 3:272a of the Wft stipulates that Section 3:9b of the Wft applies to them mutatis mutandis.² Banks and (mixed) financial holding companies must comply with these requirements by putting appropriate processes in place, in accordance with Article 91a(1-4) of the CRD. These provisions relate, among other things, to the timing of the assessment, the measures to be taken if the assessment requirements are not met, and the up-to-date nature and availability of information regarding suitability and integrity. As part of its regular supervisory activities, DNB may assess how banks and (mixed) financial holding companies fulfil this responsibility and may request further information.

Scope of external assessments by DNB or the ECB

Pursuant to Section 33(1)(d) of the Bpr, the external assessments by DNB or the ECB of key function holders is limited to a specific group, namely the heads of internal control functions and the chief financial officers employed by large institutions as referred to in Article 91a(5) of the CRD. Whether these assessments are carried out by DNB or the ECB depends on whether a bank is classified as less significant or significant. DNB is the competent authority for less significant banks, while the ECB is the competent authority for significant banks.³ Whether external assessment is required at all also depends on whether the institution in question is a large institution as defined in Article 91a(5) of the CRD (see below under ‘Assessment by DNB or the ECB applies only to large institutions’). External assessments cover both the integrity and the suitability of these staff members.⁴

Internal control functions means risk management, compliance and internal audit functions.⁵ The heads of the internal control functions means the persons at the highest hierarchical level responsible for effectively managing the day-to-day operation of those functions.⁶ The chief financial officer means the person with overall responsibility for the financial resources management, financial planning and financial reporting.⁷

If the head of an internal control function or the chief financial officer is also a member of the management body, the assessment regime for members of the management body applies. In such a case, responsibility for the internal control function or the finance function, respectively, is explicitly taken into account in the assessment.

Assessment by DNB or ECB applies only to large institutions

Furthermore, pursuant to Section 33(1)(d) of the Bpr, external assessments by DNB or the ECB of the heads of the internal control functions and the chief financial officer is limited to large institutions as referred to in Article 91a(5) of the CRD. This applies to banks (or their subsidiaries) that qualify as large institutions, as well as (mixed) financial (EU) parent holding companies whose group includes a large institution. Multiple entities may qualify as a large institution within a group. The following are classified as large institutions: global systemically important institutions (GSIs), other systemically important institutions (OSIs), one of the three largest institutions in a Member State, and institutions with total assets of €30 billion or more on an individual or consolidated basis.⁸ On a consolidated basis also means on a sub-consolidated basis. This means that institutions which, on an individual basis, do not have total assets of €30 billion or more may nevertheless qualify as large institutions if they meet this threshold on the basis of the (sub-)consolidated financial position of the parent institution, financial parent holding company or mixed financial parent holding company.⁹

Please note that the concept of a ‘large institution’ within the meaning of the CRR is not the same as that of a ‘significant institution’ (SI) within the Single Supervisory Mechanism (SSM). Although the criteria overlap to some extent, the CRR and the SSM framework have separate criteria for these classifications.¹⁰ An institution may therefore qualify as a large institution without being an SI, and vice versa. For the purposes of Article 91a(5) of the CRD, the decisive factor is whether the institution qualifies as a large institution within the meaning of the CRR.

What does this mean for banks and (mixed) financial holding companies?

DNB expects banks and (mixed) financial holding companies to comply with the requirements for key function holders from the date of implementation of CRD6.

As a minimum, this means they must:

• have adequate internal processes in place to assess all key function holders for suitability and integrity, as laid down in the Wft and CRD6;

• effectively carry out internal assessments of all functions subject to the internal assessment requirement, even if these functions are not subject to external assessment by DNB or the ECB;

• ensure that information regarding the suitability and integrity of key function holders is up to date, available and properly documented;

• submit an application for assessment to DNB or the ECB, as appropriate, in good time prior to appointing a key function holder who is subject to external assessment (the heads of internal control functions or the chief financial officer at a large institution), ensuring that the required information and forms are submitted in full and correctly so that DNB and/or the ECB can assess their integrity and suitability.