FAQ
The requirements to the application depend on the type of license it concerns. Normally, the application shall include at least the following:
- Documentation on the incorporation of the institution
- Articles of association
- Organisation and business plan for the first three financial years
- Information about the ownership and management structure
- Information about owners with qualifying holdings (≥ 10 percent of the capital or voting rights), including about their suitability
- Information about the board of directors and the management of the institution, including compliance with the fit and proper requirements
- Information about the governance and control system
- Information of how the institution shall obtain the capital required to meet the capital requirements for the business covered by the business plan
- Information about the capital structure and capital adequacy of the institution, and forecast budget for the financial situation in each of the three first operating years
- Budgets for establishment costs and administration costs
- Budgets for profit and loss account, balance sheet and cash flow analysis for each of the first three operating years
- Information of any financial group that the institution is part of
- Information about the operating set up and procedures for the business and the services that the institution shall provide
- The measures to comply with the requirements pursuant to the Anti Money Laundering legislation
The list above is not exhaustive and the legislation applicable to the relevant licensed activities contain more detailed provisions about the application and the information and documentation that shall be provided as part of the application. Finanstilsynet has published guidelines to the application process for respectively investment firms and alternative investment fund managers: Veiledning til søknad om tillatelse til å yte investeringstjenester Veiledning til søknad om å forvalte alternative investeringsfond Application for a license as insurance broker and registration as insurance agent do not require the extensive information and documentation referred above. Finanstilsynet has published guidelines applicable for insurance mediators: Krav til å drive forsikringsformidlingsvirksomhet
Contact Selmer or IKT-Norge for assistanceFor applications for a limited license as a payment institution (money remittance services), an application form may be used.
For registration of AIF managers, a registration form may be used.
Applications can be sent to Finanstilsynet, Postboks 1187 Sentrum, 0107 Oslo or to post@finanstilsynet.no.
All licence applications shall be sent to Finanstilsynet who either prepares a response for final decision by the Ministry of Finance or makes a decision itself under the mandate provided by the ministry. The authority to grant the license is delegated from the Ministry of Finance to Finanstilsynet, unless for cases of significance and/or principal character. The decision on an application for a license pursuant to the Financial Institutions Act and the Securities Trading Act, shall be communicated to the applicant within six months after receipt of the application. For applications for license as a payment institution or electronic money institution, the time limit is three months. The same time limit applies to an application for a license as an AIF manager.
If an application pursuant to the Financial Institutions Act does not contain the information required to decide whether a license should be granted, the time limit shall be reckoned from the date that such information was received by Finanstilsynet. A decision on an application shall nevertheless be communicated within 12 months after the receipt.
As from 1 December 2016, Finanstilsynet introduced a fee of NOK 30 000 for processing applications for payment institutions and electronic money institutions. A receipt for the paid fee shall be enclosed to the application. More information about the payment of the fee on the website of Finanstilsynet:
Gebyr for søknadsbehandling og innsending av søknad – E-pengeforetak Gebyr for søknadsbehandling og innsending av søknad – Betalingsforetak There are no fees for processing of other applications.
PSD 2 is a revised Payment Services Directive, which entered into force in EU 13 January 2018. PSD 2 provides the legal foundation for the further development of a better integrated internal market for electronic payments within the EU. It puts in place comprehensive rules for payment services, with the goal of making international payments (within the EU) as easy, efficient and secure as payments within a single country. It also seeks to open up payment markets to new entrants leading to more competition, greater choice and better prices for consumers. PSD 2 introduces two new payment services:
- Payment initiation services, which is a service to initiate a payment order at the request of the payment service user with respect to a payment account held at another payment service provider. This service will enable the customers to pay directly from their bank account via a third party in order to make an online purchase, instead of using a payment card.
- Account information services, which is an online service to provide consolidated information on one or more payment accounts held by the payment service user with either another payment service provider or with more than one payment service provider. This service will provide customers with a consolidated view of their bank accounts and enable them to access them by online login.
You can read more about PSD 2 and the implications for bank in this article and this article. PSD 2 entered into force in Norway on 1 April 2019.
Provision of services out of Norway
Institutions licensed in Norway, may be able to engage in similar regulated activities in another EEA state without applying for a new license in that state, but through a passporting system.
Institution entitled to passport
In order to be entitled to use the passporting system, the institution must be licensed as one of the following:
- Bank, mortgage institution, insurance undertaking, pension fund, payment institution, account information provider or electronic money institution under the Financial Institutions Act
- Investment firm under the Securities Trading Act
- Alternative investment fund manager under the Act on Management of AIFs
- Management company for securities fund under the Securities Funds Act
- Insurance intermediary under the Insurance Mediation Act
The passporting process
When considering whether to passport, you will need to decide whether you will establish a branch in the other EEA state and/or offer services cross-border into that state. You can apply for both a branch passport and a services passport, if you want to do business in both ways. The rules applying to each type of passport are slightly different. Having a branch means that you will need to comply with more of the requirements of the local legislation than you would when only providing services cross-border. The exact process for the passport notification depends on the Act that you are passporting under. However, a passporting application generally involves:
- A notification to Finanstilsynet in order to inform them that you want to passport into the other EEA state, the activities you want to passport, and whether you want a branch or a services passport.
- Finanstilsynet will notify the host state supervisor that you want to passport and provide the relevant information with the host state supervisor.
- Response/confirmation about the passport from the host state supervisor.
For some institutions there are standard forms that shall be used for the passport notification. Forms for banks and mortgage companies Form for investment firms: Form for payment institutionshttps://www.finanstilsynet.no/tema/psd-2—eus-reviderte-betalingstjenestedirektiv/grensekryssende-virksomhet-under-psd-2/
Applicable rules for the activities
When you are engaged in activities in the relevant EEA state, you will need to comply with the applicable host state rules. Which host state rules will apply to you depends on the activities you have passported and the local legislation, but generally speaking the following types of rules will apply:
- The host state rules about the conduct of your business (for example, disclosure obligations to clients and other customer protection rules)
- Additional host state rules imposed on the basis that these are in the “general good”
- Some of the host state rules about reporting and notification to the host state supervisor
In addition, you will also need to comply with the Norwegian rules, which will continue to apply to your business. The Norwegian rules on prudential requirements, and systems and controls rules will apply wherever you do your business in the EEA.
Provision of services in Norway from abroad
Institutions licensed in another EEA state, may be able to engage in similar regulated activities in Norway without applying for a new license in Norway, but through a passporting system.
Institutions entitled to passport
In order to be entitled to use the passporting system, the institution must be licensed as one of the following:
- Credit institution or financial institution pursuant to the Capital Requirements Directive
- Insurance or pension undertaking pursuant to the Solvency II Directive
- Payment institution pursuant to the Payment Services Directive
- Electronic money institution pursuant to the Electronic Money Directive
- Investment firm pursuant to MiFID
- Manager for alternative investment funds pursuant to AIFMD
- Manager for UCITS and other securities funds pursuant to UCITS
- Insurance intermediary pursuant to the Insurance Intermediary Directive
The passporting process
The exact process for passporting into Norway depends on the EEA directive that you are passporting under and the legislation in the EEA state that you are established. However, a passporting application generally involves:
- An application or notification to your home state supervisor which informs them that you want to passport into Norway, the activities you want to passport, and whether you want to establish a branch or provide the services cross-border. The requirements that apply to this notification are set by the home state supervisor.
- The home state supervisor notifies Finanstilsynet that you want to passport and providing the relevant details with Finanstilsynet.
- Response/confirmation from Finanstilsynet about the passport. If Finanstilsynet does not respond within a prescribed period (usually 2 months), you can automatically start providing your services in Norway after that period.
Applicable rules for the activities
When you are doing business in Norway, you will need to comply with the applicable Norwegian rules. Which Norwegian rules that apply, depends on the activities you have passported and the local legislation, but generally speaking the following types of rules will apply:
- The Norwegian rules about the conduct of your business (for example, disclosure obligations to clients and other customer protection rules).
- Additional rules imposed by Norwegian law on the basis that these are in the “general good”.
- Some rules about reporting and notification to Finanstilsynet.
The Norwegian rules that relate to prudential matters, such as capital requirements, will not apply. Your home state supervisor will apply and enforce its rules in relation to these matters.
GDPR (EU’s General Data Protection Regulation) is EU’s new framework for data protection. GDPR will replace the Data Protection Directive 95/46/EC and will come into effect from 28 May 2018 (also in Norway). The purpose of the GDPR is to i.a. harmonize data privacy laws across Europe, and to protect and empower all EU citizens’ data privacy. GDPR applies to all businesses established in the EU/EAA that processes personal data and also to businesses outside the EU/EEA that offers goods or services to data subjects in the EU or monitors their behaviour to the extent that the behaviour takes place in the EU. GDPR continues to a great extent the requirements that applies today, such as general requirements to processing of personal data, data subjects’ rights, routines regarding deletion etc. However, also new and significantly stricter requirements will apply, such as:
- an obligation to appoint a data protection officer for i.a. businesses where the core activities involves processing personal data involving regular and systematic monitoring of data subjects or large amounts of special categories of personal data;
- a requirement to carry out data protection impact assessments if proposed activities are likely to result in a high risk to the rights and freedoms of individuals, in particular, through the use of new technologies;
- a requirement to notify the Data Inspectorate about data breaches within undue delay and, where feasible within 72 hours, and to notify the data subjects concerned without undue delay;
- new rights for data subjects, such as data portability, the right to object to processing, the right to be forgotten and to prevent profiling;
- a requirement to implement privacy by design and default in systems, i.a. in IT systems;
- more detailed information requirements to data subjects about the businesses’ processing of personal data;
- more detailed requirements to the content in data processing agreements with data processors;
- documentation of GDPR compliance; and
- penalties for unlawful processing of personal data will increase significantly with maximum penalties of 4% annual global turnover or up to EUR 20 Million (whichever is higher).