Response to consultation on Regulatory Technical Standards to specify the minimum content of the suitability questionnaire, curriculum vitae and internal suitability assessment
Question 1: Are the draft RTS appropriate and sufficiently clear?
General comments
The Italian Banking Association supports the objective of enhancing supervisory convergence through the harmonisation of the minimum content of information to be submitted for suitability assessments under Article 91(10) of Directive 2013/36/EU as long as a consistent framework contributes to legal certainty and facilitates a coherent supervisory approach across the Union, in the spirit of proportionality and simplification as stated in particular by the European Commission in its Simpler is better Communication dated 28 April 2026 and by the EBA in its report on the efficiency of the regulatory and supervisory framework.
However, while Article 91(10) mandates the specification of the “minimum content” of the suitability documentation, several provisions of the Draft RTS appear to go beyond this mandate and risk indirectly redefining the substantive standard of suitability itself. Given that the RTS will take the form of a binding EU Regulation that is directly applicable in all Member States without the need for transposition, there is a risk that, in practice, the RTS could be treated as a standard checklist for suitability assessments. In combination with the ability of competent authorities to request clarifications or additional information, this may lead to overly documentation focused and not proportionate practices that go beyond the intended scope of Article 91(10) CRD VI.
Moreover, it is necessary to specify that the assessment of the suitability requirements is conducted primarily based on the information made available by the individual concerned and, in any case, in accordance with the national provisions implementing the CRD. Therefore, members of the management body and heads of key corporate functions must provide all information necessary to enable the competent body of the entity to perform the required evaluations and assessments, submitting such information at the time of appointment and whenever subsequent events arise that may affect their suitability.
The cumulative effect of the proposed requirements transforms what is intended to be a prudential assessment into a highly granular and formalised documentation exercise. In our view, the RTS should remain strictly confined to defining the information necessary to perform the assessment, without introducing additional substantive expectations not expressly grounded in Level 1 legislation. More concretely, the following amendments are suggested:
- article 1: Article 1(b) defines the suitability questionnaire by referring to Article 91(1e)(a) of Directive 2013/36/EU. This reference is problematic at two distinct levels.
First, Article 91(1e)(a) concerns the documentation to be submitted to the competent authority in the context of an ex-ante suitability application. As clarified in recital 49 of Directive (EU) 2024/1619 (CRD VI), this procedural framework is only relevant in Member States where the suitability assessment by the competent authority is carried out after the member of the management body has taken up the position. Consequently, referring to Article 91(1e)(a) is not appropriate for Member States where competent authorities assess suitability before the member takes up the position (as the ex‑ante suitability application does not apply in such Member States).
Second, the reference to Article 91(1e)(a) is also inappropriate in terms of personal scope. Under CRD VI, the obligation to submit an ex‑ante suitability application to the competent authority applies only to the appointment of members of the management body in its management function and to the chair of the management body in its supervisory function. By referring to Article 91(1e)(a), Article 1(b) of the draft RTS risks extending these procedural obligations to all members of the management body and to key function holders (the latter being, under CRD VI, subject only to an ex-post suitability assessment and only in large entities), thereby going beyond the scope and mandate conferred on the EBA under Article 91(10) CRD VI.
Article 1(b) should therefore be aligned with the Level 1 framework and reflect the limited procedural and personal scope of Article 91(1e)(a), to ensure legal certainty and compliance with the mandate set out in CRD VI;
- article 4: the requirement that non-material weaknesses must be remedied within a maximum period of six months introduces a rigid timeframe not foreseen in CRD VI. Suitability under Article 91 is framed as an ongoing and principle-based obligation. While remedial measures are appropriate where weaknesses are identified, the imposition of a fixed maximum period may not be suitable in all circumstances, particularly in complex institutions or in cases involving specialised knowledge. We would therefore suggest replacing the six-month maximum with a requirement that remedial measures be implemented within a reasonable and proportionate timeframe, considering the nature of the identified gap and the responsibilities attached to the position;
- article 5: concerning the assessment of reputation, honesty and integrity, the article raises significant concerns. As a preliminary remark, the repeated use of the expression “at least” when referring to the information to be collected should be reconsidered. In this context, the deletion of the wording “at least” would be appropriate, as it would avoid establishing an exhaustive or cumulative documentation expectation that may not be feasible in practice and would better reflect the principle-based nature of the suitability assessment.
In addition, several of the documents and pieces of information envisaged under article 5 may not always be realistically obtainable by the individual, particularly in cross-border situations or where national authorities do not issue the specific certificates contemplated. In such cases, it should be expressly clarified that duly signed declarations by the candidate, made in good faith and to the best of their knowledge, may suffice, subject to subsequent verification where necessary. A rigid documentary requirement may otherwise create disproportionate barriers and legal uncertainty, particularly as it would de facto require individuals to evidence the absence of adverse elements relating to good repute, honesty and integrity.
Furthermore, the provision referring to “any other reliable internal or external resources available to the entity” remains excessively open-ended and may generate inconsistent interpretation and over-collection of personal data. The RTS should clarify that only information that is objectively relevant, proportionate and directly related to the suitability assessment under Articles 91 and 91a CRD may be considered, in line with the principles of necessity and data minimisation and in full compliance with fundamental rights as enshrined in the Charter of Fundamental Rights of the European Union, in particular Article 7 concerning the respect for private and family life. Finally, although the presumption of innocence is referenced, the overall structure of the provision risks creating indirect adverse consequences for individuals based solely on the existence of ongoing investigations or unresolved allegations. It should therefore be explicitly clarified that the mere existence of investigations or proceedings does not give rise to a presumption of unsuitability, unless there are objective and substantiated grounds directly attributable to the individual concerned.
Moreover, it is important - both in the Regulation and in the Guidelines - not to assign relevance to administrative proceedings, given, on the one hand, the embryonic stage of such proceedings and, on the other, their limited significance; a similar argument applies to potential civil judgments, which do not appear to affect reputation requirements but would instead excessively broaden the range of relevant cases. In practice, the application of Article 5 may also lead to the repeated submission of suitability-related information that is static, including information that may already be available to competent authorities in the EU from previous assessments. The Draft RTS do not sufficiently clarify that information which is static and already available to EU competent authorities should, in such cases, not be requested again. If EU competent authorities want to double-check whether the relevant persons have indeed been assessed, we propose they liaise with the competent authority that is responsible for the ongoing suitability requirement. Repeated resubmissions of static information that has already been provided results in procedurally repetitive and resource-intensive processes for institutions and individuals, without a clear added value for the assessments;
- article 6: the additional requirement concerning the obligation to provide evidence of independence of mind is particularly problematic (Article 6(1)(a)). We do not see what evidence, other than a self-declaration, we could provide;
- article 7: relating to time commitment, this article requires detailed annual estimates of time devoted to mandates, number of meetings and time allocation per activity. While sufficient time commitment is clearly required under Article 91 CRD, the level of predictive quantification required by the RTS is inherently speculative and may expose both institutions and candidates to supervisory scrutiny based on ex post deviations from ex ante estimates. The RTS should clarify that time commitment assessments may be based on reasonable and good faith estimates, without requiring precise quantitative forecasting that cannot realistically be guaranteed;
- article 8: it requires identification of gaps in collective suitability and detailed remedial planning, may also benefit from a clearer articulation of proportionality. While collective competence is a central element of the suitability framework, the RTS risk imposing a uniform and formalised assessment structure irrespective of institutional size, complexity or governance model. A clarification that the depth and format of the collective assessment must be proportionate to the nature, scale and complexity of the entity would ensure alignment with the proportionality principle embedded in CRD VI. In this respect, the reference in Article 8(2) to individual statements under Article 88(3) CRD illustrates how governance tools intended for the internal allocation of roles and responsibilities risk being used as mandatory evidence for collective suitability under Article 91 CRD VI. This may shift the assessment of collective suitability from a principle-based approach towards a more tool driven and prescriptive process;
- article 10: it establishes joint responsibility of the candidate and the entity for the completeness and accuracy of the information provided. While transparency is essential, the current drafting may create disproportionate personal exposure and disincentivise qualified independent candidates from accepting board positions, particularly in significant institutions subject to heightened scrutiny. It would therefore be appropriate to clarify that such joint responsibility relates to the provision of information in good faith and to the best of the knowledge of the signatories at the time of submission and does not create strict liability for omissions that were not reasonably knowable.
Moreover, it is important to distinguish the respective responsibilities of the individual and of the institution in providing the information required by the Authority, bearing in mind that the institution may be responsible for aspects concerning the assessment conducted at both individual and collective level, but not for information pertaining specifically to the individual.
In addition, certain related requirements within the RTS appear excessively broad. The reference to information covering a period of ten years may in many cases be disproportionate to the objective pursued, particularly where the relevance of older information is limited or remote. A shorter, risk-based timeframe would better reflect the principle of proportionality embedded in CRD VI.
Likewise, the requirement to disclose relationships with “suppliers or competitors” is formulated in overly expansive terms and may capture a wide range of ordinary professional or commercial interactions that are not materially relevant to the suitability assessment. Greater precision is needed to ensure that only relationships of a material nature, capable of giving rise to genuine conflicts of interest, are required to be disclosed.
Regarding the detailed information listed in par. 2, we consider necessary to:
- letters i) and j): a) remove the obligation to provide information on any commercial/professional relationships maintained by the individual, their close family members, or companies in which the individual holds or has held a corporate office, with suppliers and competitors of the bank, considering the significant number of parties involved and the limited added value such information provide in terms of managing conflicts of interest. Alternatively, such mapping should be strictly limited to relationships maintained solely by the individual with the bank’s main suppliers and competitors, meaning, for example, the top 5 or top 10; b) limit the set of personal, business and professional relationships with members of the management body or key function holders - especially those of other Group companies - and with qualifying shareholders to those that are significant.
- letter k): remove the obligation to provide information on any financial relationships with the bank and the group maintained by companies in which the individual previously held a corporate office, as these relationships are irrelevant for managing conflicts of interest, given that the individual no longer has any interest in the company concerned. Alternatively, a time limit should be introduced to define the period within which such mapping should be carried out;
- article 11: we propose to delete the wording “at least”. The proposed information in CV in the article 11 of the RTS is sufficient for the suitability assessment.
More broadly, the AML-related dimensions embedded throughout the RTS should be carefully calibrated. Suitability assessments must remain individualised. The existence of AML supervisory findings at entity level should not, in itself, affect the suitability of all current or prospective members of the management body. It should be clarified that entity-level deficiencies do not automatically translate into individual unsuitability unless there is demonstrable and specific responsibility attributable to the individual concerned.
Finally, it is important to remark that the RTS require the collection and submission of highly sensitive personal data, including criminal records across jurisdictions, financial obligations and information relating to family relationships. Considering applicable regulations, it would be appropriate to include an explicit clarification that the collection and processing of such data must comply with the principles of necessity and proportionality and be limited to what is strictly required for the suitability assessment.
In conclusion, while we support the harmonisation objective underlying Article 91(10) CRD VI, we respectfully submit that the Draft RTS would benefit from recalibration to ensure that they remain within the scope of defining minimum content, preserve proportionality and legal certainty, fully respect the presumption of innocence and fundamental rights, and avoid transforming the suitability framework into an excessively rigid and formalistic compliance regime.
Below are the proposed reformulations of the draft Regulation. - Please see the attached file for a clearer indication of the parts to be deleted
Article 2: please add the following final sentence: The overarching exemptions set out in Article 91(13) and (14) of the CRD remain unaffected by the provisions of the RTS.
The assessment of the suitability requirements is carried out on the basis of information provided by the member of the management body concerned and, in any case, in accordance with national regulations implementing Directive 2013/36.
Article 4 (1): please change as follows: The assessment of the individual’s knowledge, skills and experience shall ascertain whether the individual has the appropriate knowledge, skills and experience for the position sought, including whether the individual’s education and professional experience are relevant and sufficient in light of the role, responsibilities and duties of the position.
Article 5, paragraph 2, please change as follows: When considering any relevant criminal (delete: "or administrative") records or proceedings or administrative sanctions, the individual assessment shall take into account […].
Article 5, paragraph 3: The assessment shall be based at least on the following information:
[…] (b) relevant (delete: "civil,") administrative and disciplinary decisions, including bankruptcy,
insolvency and similar procedures […]
Article 6, (1) please change as follows: The assessment of the individual member’s independence of mind shall cover, at least, information on the following:
(a) any evidence, that can be a self-declaration, that suggesting that the individual has the necessary behavioural skills, including:
1. the ability to present their views, discuss strategies and business objectives to effectively, critically and independently assess and challenge the proposed decisions of other members of the management body; and […]
Article 10, please change as follows:
Paragraph 1:
The individual and the entity shall be (delete: "jointly" )responsible - each one for the information within their own remit - for providing the competent authority with complete and accurate information regarding the proposed appointment. In this regard, the individual and the entity have the responsibility to disclose to the competent authority all matters that may be relevant to the assessment.
Paragraph 2:
(i) any of the material individual’s personal, business or professional relations with: i. other members of the management body and/or key function holders of the institution, the parent undertaking or their main subsidiaries; ii. qualifying shareholders of the entity, the parent undertaking or their main subsidiaries;
(delete: "iii. suppliers or competitors of the entity, the parent undertaking or the entity’s subsidiaries. (j) any personal, business or professional relations provided under letter (i) related to individual’s close relatives and any legal person in which the individual is or was a member of the management body, or a qualifying shareholder, at the relevant time; )
(k) any financial obligations towards the entity, the parent undertaking or their subsidiaries the individual or his close relatives or any legal person in which the individual is (delete: "or was") a member of the management body, or a qualifying shareholder, (delete: "at the relevant time"), have, including any loans of any value that are not negotiated under market’s conditions or are non-performing.