CRD VI lands in Austria: new transaction gates, tougher fit & proper rules and measurable ESG plans

Key points at a glance

1 Transactions 

New notification and supervisory clearance requirements may affect acquisitions, transfers, mergers and internal reorganisations.

2 Governance

Fit & proper becomes an ongoing duty, extending to key function holders and documented responsibility maps.

3 ESG

Institutions must translate ESG risk strategy into actionable plans with quantifiable targets and clear ownership.

4 Third-country business

Austria retains a strict licensing approach; branch classification and reverse-solicitation evidence require attention.

On 14 October 2026, the Austrian National Council adopted legislation implementing CRD VI. Most provisions will enter into force on the day following publication in the Federal Law Gazette. The core rules for branches of third-country banks will apply from 11 January 2027.

The reform implements CRD VI alongside targeted amendments prompted by other EU legislation. It changes the Austrian Banking Act (BWG), the FMA Act and several other financial-market laws. Its impact extends beyond traditional banks to financial holding companies, investment firms and parts of the asset-management sector.

Bank transactions: three new regulatory gates

The most immediate commercial impact concerns prudentially relevant financial sector M&A transactions. The reform replaces parts of Austria's existing approval regime with harmonised notification and assessment procedures. The new rules also warrant attention where no bank is being acquired, as investments in non-financial businesses and internal reorganisations may require a separate regulatory assessment.

The terminology matters: not every transaction formally requires approval. Depending on the nature of the transaction, the new regime ranges from advance notification to a full prudential assessment or express authorisation.

Main aspects are:

• For acquisitions and disposals of material holdings, a credit institution or licensed financial or mixed financial holding company must notify the competent supervisory authority before acquiring a direct or indirect holding valued at 15 % or more of the acquirer's eligible capital. The competent authority may prohibit the acquisition within the statutory assessment period. Planned disposals must also be notified in advance.
  
  
• In the case of material transfers of assets or liabilities, prior notification is required where the transferred assets or liabilities reach 10 % of the institution's total assets or liabilities. A 15 % threshold applies to intragroup transactions. Certain NPL, covered-bond, securitisation and resolution transactions are excluded from the threshold calculation. This is new for Austria, because asset deals were arguably not yet covered by the former approval obligations under the local Austrian regime.
  
  
• Mergers and demergers involving institutions or licensed holding companies must be notified once the relevant plan has been adopted. They may generally not be completed without the required supervisory clearance, and entry in the companies register requires a final decision. For transactions within the same group, the FMA must decide within 60 working days; clearance is deemed granted if the FMA does not prohibit the transaction within that period.

The supervisory review will cover the prudential soundness of the transaction. The framework also allows the FMA or ECB to address risks connected with high-risk third countries and material AML deficiencies.

Non-compliance can have serious consequences. These include fines of up to EUR 5m or twice the benefit derived from the breach. Where an acquisition proceeds despite a supervisory prohibition, the voting rights attached to the relevant shares or interests are suspended until the FMA finds that the ground for the prohibition no longer exists.

The existing national approval requirements in Section 21(1) Nos. 1, 6 and 7 BWG will be repealed. Proceedings already initiated under those provisions will continue under the previous regime. Institutions with transactions already in preparation should therefore determine precisely when the new rules apply and whether a filing under the existing regime remains available.

Fit & proper becomes a continuous governance obligation

The substantive suitability criteria do not change fundamentally. The assessment process, documentation and supervisory consequences become more prescriptive.
Institutions must assess the suitability of members of their management and supervisory bodies before they take up their roles and reassess them periodically. A new assessment is also required if relevant facts emerge that may affect their suitability. For specified large institutions and relevant holding companies, new management and supervisory board chair appointments must be notified to the FMA once there is a clear intention to appoint and at least 30 working days before the appointee takes up the role.

The reform also grants a more distinct legal status to key function holders. These are individuals who exercise far-reaching influence over the management of an institution without being members of its management board. They include the heads of internal control functions and the CFO, where these roles are not held by management board members. Institutions will need reliable procedures to identify these individuals, assess their suitability and document reassessments. These procedures include:

• Dedicated control functions: Each internal control function must be headed by a dedicated manager. For risk management and compliance, the FMA may, upon application, allow another senior manager of the institution to assume the role, provided that the nature, scale and complexity of the business do not justify a dedicated appointment, no conflict of interest arises, and the person is suitable and has sufficient time to perform the role.
  
  
• Protected independence: The relevant control-function heads may not be removed without the supervisory board's prior consent.
  
  
• Documented accountability: Responsibilities, reporting lines and decision-making powers must be clearly documented through individual statements of responsibilities and an overall mapping of duties.

The practical message is clear: fit & proper can no longer be treated primarily as an onboarding exercise. It becomes an ongoing governance process that must withstand supervisory scrutiny. Institutions should assess whether board rules of procedure, role descriptions and reporting lines consistently reflect the responsibilities assigned in practice.

ESG moves into the prudential core

CRD VI integrates ESG risks more firmly into banks' governance and risk-management frameworks. Institutions must identify, measure, manage and monitor the financial risks arising from ESG factors over short-, medium- and long-term horizons.

A central element is the requirement to prepare plans addressing these risks. The plans must set out quantifiable targets and procedures, and must be approved by the management board, which must also monitor their implementation. Proportionality applies, with simplified expectations for small and non-complex institutions.

The FMA will consider ESG risks and the institutions' plans in the supervisory review and evaluation process. Institutions should therefore ensure that their plans are linked to risk appetite, portfolio steering, internal controls and management information. A general sus-tainability strategy will not, by itself, be sufficient.

Third-country access: Austria maintains a strict line on reverse solicitation

For cross-border business, the most consequential point in the Austrian package is what it does not say. CRD VI requires third-country undertakings to establish an authorised branch before providing core banking services in a Member State. The Austrian legislator takes the view that no transposition of Article 21c CRD VI is needed, because the Banking Act already achieves the same result. Carrying on any banking activities subject to a credit institution licence requires the establishment of an Austrian entity or, at a minimum, a third-country branch.

Why this matters in practice

As Article 21c CRD VI is not transposed as such, its carve-outs are not written into Austrian law either. The directive expressly exempts services provided at the client's own ex-clusive initiative, business with credit institutions and intragroup business, MiFID services together with accommodating ancillary services, and existing contracts entered into before 11 July 2026. None of these appears as an express exemption in the Austrian text.

Substantively, nothing softens. Reverse solicitation has always been possible in Austria and will remain so: the licence requirement applies to the active offering of banking business, not to a client's own reverse approach. What the exemption will not become is a statutory position. The exemption remains an unwritten boundary of the licence requirement, to be established on the facts of each relationship, while reverse solicitation appears in the Banking Act only as a reporting item for certain branches.

Consequences for third-country groups

• No statutory safe harbour: Whether an approach was made exclusively at the client's own initiative remains a question of fact to be assessed. The directive makes clear that solicitation through an affiliate, a closely linked entity or any per-son acting on the undertaking's behalf defeats the exemption. Nor does a client's initiative permit the marketing of product categories beyond those initially solicited and services closely related to them. Although not formal law, the limitations set out in Art 21c CRD VI should still be observed as a guardrail. For Austria, additional safeguards are advisable, including, where practicable, conducting negotiations outside Austria and signing the agreement abroad.
  
  
• No express grandfathering of legacy contracts or exemptions: Article 21c(5) CRD VI expressly preserves existing contracts entered into before 11 July 2026 while Article 21c(2) CRD VI exempts business with credit institutions and intragroup business. The Austrian legislation contains no corresponding express provisions, leaving the treatment of existing contracts and exemptions under Austrian law to be assessed separately.
  
  
• Documentation becomes the defence: With branch reporting now capturing head-undertaking reverse-solicitation business, contemporaneous evidence of client-side initiative, scope of mandate and marketing channels is what will determine the outcome of an FMA enquiry.

Third-country branches: a harmonised framework from 2027

From 11 January 2027, Austrian branches of third-country credit institutions will be divided into Class 1 and Class 2 branches. Classification will depend on factors including the branch's size, funding structure and qualification under the CRD VI framework. As mentioned, Austria retains its full banking licence and bank-level requirements for all third-country branches.

Branches will also need a robust booking framework that identifies the assets and liabilities attributed to their Austrian operations. In specified circumstances, particularly where a branch reaches relevant size or systemic-importance thresholds, the FMA may require the third-country group to conduct its Austrian business through a subsidiary instead.

Stronger enforcement powers

The reform gives the FMA a new instrument to compel the restoration of compliance. Periodic penalty payments may reach 5 % of average daily net turnover per day for legal persons and EUR 50,000 per day for responsible natural persons. They may be imposed for up to six months and can apply not only to institutions but, where the statutory condi-tions are met, to responsible individuals.

Changes beyond the BWG

The reform also introduces several changes affecting investment firms and the FMA. A new Section 7a WAG 2018 establishes a separate FMA approval requirement for mergers, demergers and changes of legal form involving investment firms and investment service providers, as well as their third-country branches. The package also amends the rules governing third-party execution and research services. In addition, certain large investment firms will be required to obtain authorisation as credit institutions. Finally, the reform strengthens the FMA's governance framework by tightening independence and conflict-of-interest rules, including through cooling-off periods, declarations of interests and trading restrictions.

What institutions should do now

• Review planned transactions. Check thresholds and transitional rules, including for intragroup reorganisations.
  
  
• Align deal documents and timetables. Reflect regulatory requirements in closing conditions, long-stop dates and cooperation clauses.
  
  
• Review governance arrangements. Update fit & proper processes and align documented responsibilities with actual decision-making.
  
  
• Make ESG plans actionable. Set measurable targets, clear ownership and monitoring processes.
  
  
• Reassess cross-border business. Review reliance on reverse solicitation, supporting evidence and the treatment of existing contracts.

The reform goes well beyond additional reporting requirements. It changes how Austrian financial institutions execute transactions, appoint senior decision-makers and demonstrate effective risk governance. Institutions that act early will be better positioned to avoid deal delays, complications with senior appointments and supervisory intervention.

For institutions with a transaction or senior appointment in preparation, an initial review can identify the applicable procedure, timing constraints and documentation gaps. Schoenherr supports clients with transaction-specific regulatory assessments, governance reviews and preparation for supervisory engagement.

Author: Matthias Pressler, Moritz Neumair