The 2026 Substance Bar: What EU Supervisors Actually Inspect

Substance is the most-changed dimension of EU regulator inspection in the last four years. The bar that satisfied authorisation in 2020 fails inspection in 2026 — not because the rules in the directives changed materially, but because the supervisory interpretation of those rules has hardened. Founders who built EMI or CASP structures in 2020–2022 with Vilnius offices and Tel Aviv management are now being asked to evidence things their original structures cannot evidence.

This article codifies what we call the 2026 Substance Bar — the seven dimensions ESMA, EBA, and the national competent authorities now inspect when they look at a regulated firm's substance footprint. The Bar is descriptive: it reflects what the supervisor actually does in 2026, not what the directive textually requires. It is also forward-looking: under AMLR application from 10 July 2027, the Bar tightens further still.

This guide covers what 'substance' means in 2026, the seven dimensions in detail, the shop-window failure pattern, inspection mechanics, cohort-specific expectations, and the year-on-year delta from the 2022 baseline.

The substance test under MiCA¹^[1], EMD2 and PSD2 has always required "effective management" in the licensing jurisdiction. Pre-2022, the test was met by a registered office, a local director, and quarterly board meetings on paper. In 2026, the test requires evidence of operational decisions actually being taken in country — typically captured through residence patterns, payroll records, headcount geography, IT infrastructure location, and demonstrable board-meeting substance.

The shift is principally a function of three forces. First, post-2022 ECB and EBA peer reviews surfaced significant substance gaps in EMI authorisations across the EEA. Second, MiCA forced a fresh look at substance for newly-authorised CASPs. Third, AMLR introduces explicit substance expectations linked to AML programme effectiveness — under AMLR, MLRO independence and substance are not separable.

CEO and MLRO resident in the licensing jurisdiction, full-time, with employment contracts. Non-executive directors based abroad are acceptable, but the executive function must be in country. Evidence: tax-residence certificates, payroll records, time-spent-in-country data. The 2020 pattern of "part-time CEO, two days a month in Vilnius" is now refused at authorisation.

Material decisions — pricing, product, customer onboarding policy, risk appetite, AML calibration — must be taken in the licensing jurisdiction, not ratified locally after the fact. Evidence: board-meeting minutes with substantive deliberation, executive-committee records, decision-tracking that ties to in-country meetings. The EBA²^[2] supervisory expectations under EBA/GL/2021/05 frame this dimension precisely.

Headcount in country at authorisation, scaling with cohort. Indicative thresholds in 2026: 5–10 FTEs at authorisation for a small-cohort EMI; doubling within year 1; 25–40 by mid-cohort. The bar specifically targets non-trivial roles — ops, compliance, customer-service, finance — not just a CEO with a personal assistant. Evidence: organisational chart with named individuals + payroll records.

Real office space — signed lease, photographs, on-site visit during diligence — not a serviced address or virtual office. The supervisor's substance assessment in 2026 includes physical inspection of the named address with the named team in residence. The 2020-era WeWork desk pattern is now flagged as substance-light at authorisation.

Board meetings physically in the licensing jurisdiction, at least quarterly, with substantive agenda items, attendance records, and resolutions tracking. Video-only board meetings are no longer sufficient as the default. Evidence: minutes with location field populated, attendance roster, expense records of director travel.

Material customer-data and transaction-data infrastructure must be hostable in EU jurisdictions. DORA³^[3] Article 28 third-party-risk obligations require documented ICT supplier locations; supervisors increasingly probe whether the firm's primary data infrastructure sits in EU regions, with cross-border-data-flow documentation under GDPR. The pattern of US-only cloud deployment without EU residency is a 2026 substance flag.

UBO traced to natural persons, source-of-wealth dossiers for any UBO above 25%, no opaque holding-company layers. AMLR⁴^[4] extends this with control-other-than-ownership identification (control through voting rights, contractual arrangements, board appointments). The 2026 Bar requires natural-person UBO identification at every level of the structure, not just at the licensed entity.

The most-cited substance failure mode in 2026 supervisory findings is the shop-window pattern — a Vilnius / Limassol / Dublin office with two compliance staff and a CEO title, while all real activity (engineering, ops, executive decisions) happens elsewhere. The pattern is detectable through:

• Mismatch between board minutes location and director travel records.

• Internal communications metadata showing decision-flow originating offshore.

• Vendor invoices for engineering, marketing, and product addressed to non-EEA entities.

• Customer-facing communications that name personnel based offshore as the operational team.

Existing licences operating in this pattern have been re-examined since 2023; new authorisations refusing to commit to in-country substance are no longer granted.

Substance is inspected through a combination of:

• Documentary review of organisational charts, payroll, board minutes, lease agreements, IT supplier registers.

• On-site visits — physical office walk-through, named individuals at desks, IT infrastructure inspection.

• Fit-and-proper interviews with named executives — substance is tested by what the CEO knows about the firm's operational reality.

• Cross-reference against publicly available data — LinkedIn employer locations, press mentions, customer-facing personnel claims.

Year 1 authorisation diligence is shallower; year 3 thematic review is materially deeper. Substance maintained at year 1 but eroded by year 3 (key personnel moved, board meetings drifted to video) is one of the more common 2026 findings.

5–10 FTEs in country, lease signed, CEO + MLRO resident, board cadence committed in operating procedures. The bar at authorisation is set deliberately high so that supervision can rely on the baseline through year 1.

Doubling of FTE; quarterly board meetings actually run; first ICAAP submitted; first thematic review by the supervisor. Substance verified through documentary review.

Substance retest with on-site visit. The 25–40 FTE expectation by mid-cohort applies. AMLR-aligned MLRO independence and seniority are tested. Most existing-licence remediation findings emerge here.

The 2022 baseline was already meaningful — but four years of supervisory review cycles have lifted the bar materially:

No. The Bar is descriptive — it codifies what supervisors actually inspect, based on practitioner observation across multiple authorisation and supervisory cycles. The underlying expectations are anchored in MiCA, EMD2 / PSD2, EBA guidelines, and AMLR — but the 2026 calibration of those expectations is supervisory practice, not text.

Run a substance gap analysis against the seven dimensions. If two or more dimensions show material gap, plan remediation before the next thematic review (typically year 3 or 4 of authorisation). Substance gaps are remediable in 12–18 months with deliberate planning; the cost of remediating in 90 days post-finding is materially higher.

Yes. AMLR introduces explicit MLRO independence and seniority requirements that interact with substance — a thinly-resourced MLRO is a substance failure, not just an AML failure. AMLA direct supervision of selected entities adds an annual on-site cadence that compounds the year-3 review pattern. Plan for the 2027 Bar in the 2026 build.

Partial outsourcing is acceptable for non-executive functions — IT, audit, compliance retainer support. Executive substance (CEO, MLRO) cannot be outsourced; nor can material decision-making. The pattern of "director-for-hire" services that satisfied 2020 expectations is now a substance failure indicator under the 2026 Bar.

The seven dimensions apply uniformly. The interpretation cadence varies — Lithuania, Cyprus, Ireland, Luxembourg, Netherlands and Germany have all materially raised their substance expectations since 2022, with Germany and the Netherlands typically setting the strictest interpretation. AMLR will harmonise the interpretation further from 2027.

• EMI Licence Application in Lithuania — substance bar applied to a single jurisdiction.

• EMI Licence Application in Cyprus — alternative jurisdiction with the same substance expectations.

• MiCA Compliance Guide for CASPs — authorisation framework that interacts with the Bar.

• AMLR Readiness 12-Month Roadmap — the next-cycle hardening of the Bar.

• Regulatory Legal Opinions — our service: substance gap analysis, remediation, supervisor engagement.

The 2026 Substance Bar is not a regulator's publication; it is the working consensus of supervisory practice. The bar will continue to harden through AMLR application in 2027 and beyond. Cite the seven dimensions as the finconduit 2026 Substance Bar with attribution; revisit your firm's position annually as the bar moves.