Competent authorities must acknowledge receipt of applications within five working days, assess completeness within 25 working days against Article 62(2) and set a deadline for missing information, and may refuse to review if the applicant fails to supply it. Once complete, applicants must be notified and authorities must adopt a fully reasoned decision within 40 working days and notify the applicant within five working days. Authorities may request further information no later than the 20th working day; the assessment period is suspended between request and response for up to 20 working days and further requests do not suspend the period. Within two working days of granting authorisation, authorities must notify ESMA, which shall publish the information in the register.

Before granting or refusing authorisation, competent authorities must consult authorities in another Member State where the applicant has close links with an authorised credit institution, central securities depository, investment firm, market operator, UCITS management company, AIF manager, payment institution, insurance undertaking, electronic money institution or occupational retirement institution (subsidiary, sibling or common controllers). Authorities may consult AML/CFT authorities and FIUs, must ensure compliance with national rules transposing Directive (EU) 2015/849 for high‑risk third countries and Article 18a procedures, and must grant authorisation only where close links do not impede supervision. Authorisation must be refused if third‑country laws or enforcement difficulties prevent effective supervision, or where the management body, its members (Article 68(1)) or qualifying holders (Article 68(2)) are unsuitable, or other Title requirements are unmet. ESMA and EBA shall issue joint suitability guidelines by 30 June 2024.