International Regulatory Considerations for Cross-Border FIG Deals

Introduction

Cross-border financial institution M&A operates in a regulatory environment of extraordinary complexity. A domestic bank merger in the US requires approval from two to four agencies, and under the faster review climate since 2025 large deals have cleared in a matter of months. A cross-border deal involving a US acquirer and a European target can require approvals from ten or more regulators across multiple jurisdictions, each with different statutory mandates, review timelines, and political dynamics. Add divergent capital frameworks (US Basel III Endgame vs. EU CRR3 vs. UK Basel 3.1), different insurance capital regimes (RBC vs. Solvency II), and evolving third-country access rules (CRD VI), and cross-border FIG deals become the most regulatory-intensive transactions in investment banking. For FIG bankers, understanding these layers is essential: the regulatory landscape often determines whether a cross-border deal is feasible before the financial analysis even begins.

Every cross-border FIG transaction requires navigating multiple regulatory bodies, each with distinct review criteria and timelines.

In the US, the Federal Reserve evaluates ownership and control changes for bank holding companies. The OCC supervises nationally chartered banks. The FDIC reviews transactions involving insured depository institutions. The DOJ conducts antitrust review, analyzing deposit market concentration through HHI analysis. For insurance acquisitions, state regulators review Form A change-of-control applications, often in multiple states simultaneously.

In the EU, the European Commission handles antitrust clearance under the EU Merger Regulation. The ECB provides prudential approval for acquisitions of qualifying holdings in significant banks, working from assessments prepared by national competent authorities such as BaFin in Germany and the Banco de España. Deals that fall outside the EU Merger Regulation go instead to national competition authorities: Spain's CNMC, not Brussels, reviewed BBVA's bid for Sabadell. In the UK, the PRA leads on prudential review while the FCA evaluates conduct implications.

CFIUS Review

The Committee on Foreign Investment in the United States (CFIUS) reviews foreign acquisitions of US businesses for national security implications. Financial institutions, with their access to sensitive personal financial data, payment systems, and critical infrastructure, routinely trigger CFIUS review. According to the CFIUS annual report for 2025, the committee assessed 140 declarations (up from 116 in 2024), 51 of them subject to mandatory filing, and reviewed 207 full notices. Maximum penalties for non-compliance were raised from $250,000 to $5 million per violation as of December 2024. At least one case resulted in a $60 million penalty for mitigation agreement non-compliance. While CFIUS has not blocked a major bank acquisition in recent years, the review adds 45-90 days to transaction timelines and can impose mitigation requirements (data security protocols, board composition restrictions, operational separation of sensitive functions) that materially affect deal structure.

The practical impact on deal timelines is significant. US domestic bank deals have compressed sharply under the current administration's streamlined review approach: the Fed approved Fifth Third's acquisition of Comerica on January 13, 2026, roughly three months after the October 2025 announcement. Cross-border deals routinely take 12-18 months as sequential and parallel regulatory reviews compound. The timeline uncertainty itself becomes a deal risk: market conditions can shift, financing commitments can expire, and competing bidders can emerge during extended review periods.

The three major banking jurisdictions are implementing the final Basel III reforms on different timelines and with different calibrations, creating a period of regulatory fragmentation that directly affects cross-border competitive dynamics and deal analysis.

The EU moved first, with CRR3 taking effect January 1, 2025, introducing revised standardized credit risk approaches and the output floor phasing in from 50%, while the FRTB market risk framework has been pushed back to January 2027. The UK postponed Basel 3.1 several times; the PRA's final Basel 3.1 rules take effect January 1, 2027, with the FRTB internal model approach deferred to January 2028. The US changed course: the Fed, OCC and FDIC re-proposed the rules in March 2026, replacing the dual standardized/advanced calculation for the largest banks with a single expanded risk-based approach and projecting a modest decrease in overall capital, reversing the 2023 proposal's increase. Implementation is expected from 2027 once the rule is finalized.

CRD VI, with member state transposition required by January 10, 2026 and most provisions applying from January 11, 2026, introduces new rules governing how banks from non-EU countries (primarily US and UK banks post-Brexit) can operate within the EU.

Under Article 21c of the new framework, third-country banks can no longer provide core banking services (deposit-taking, lending, guarantees) on a cross-border basis into the EU without local authorization. They must establish either an authorized EU branch in each member state where they operate or an EU-authorized subsidiary. This branch requirement applies from January 11, 2027, a year after the rest of the directive.

Exemptions exist for interbank and intragroup services, reverse solicitation (customer-initiated requests), and MiFID II-covered investment services. As the EBA's Article 21c report notes, contracts entered into by July 11, 2026 keep grandfathered treatment. Third-country branches must comply with EU minimum requirements on capital, liquidity, and internal governance. Branches are sorted into Class 1 and Class 2: Class 1 captures larger or riskier branches (booked assets of €5 billion or more, material retail deposit-taking, or a home regime that does not meet EU standards) and carries the heavier capital, liquidity and reporting requirements.

For US and UK banks with significant EU operations, CRD VI forces a strategic choice: restructure to establish authorized branches or subsidiaries (with the associated capital, governance, and operational costs), or retreat from certain EU banking activities. This structural requirement increases the operating costs of maintaining cross-border banking platforms and adds another layer of complexity to cross-border M&A integration planning.

Cross-border insurance M&A faces its own regulatory complexity. Solvency II sets capital on a market-consistent balance sheet calibrated to a 1-in-200-year loss, while US RBC applies statutory factors to largely undiscounted reserves, so the same book of business can carry a materially different requirement in each regime. Acquirers in either direction must rebuild the target's capital position under their home regime before judging excess capital, dividend capacity and price.

The 2017 US-EU Covered Agreement provides some relief: insurance and reinsurance groups operating in both jurisdictions are subject to worldwide group supervision by their home supervisor, and qualifying reinsurers are relieved of local collateral and presence requirements. Bermuda and Switzerland are the only jurisdictions recognized as fully equivalent to Solvency II, giving Bermuda-domiciled groups a structural advantage in cross-border insurance transactions.

UK ring-fencing rules (applying to banks holding over £35 billion in core deposits with material trading operations, a threshold raised from £25 billion in February 2025) add another constraint. The 2025 reforms lifted the bar on ring-fenced bodies operating outside the UK and EEA, subject to PRA safeguards, and HM Treasury's May 2026 review proposed a growth allowance for limited otherwise-prohibited activity. For cross-border acquirers, understanding whether a UK target's operations fall within the ring-fence is critical to assessing what activities can be integrated post-acquisition.

Cross-border FIG M&A sits at the intersection of every regulatory topic covered in this section: capital requirements, stress testing, G-SIB surcharge management, insurance capital regimes, and Dodd-Frank's enhanced prudential standards. The regulatory complexity does not eliminate cross-border deal activity, but it raises the execution bar significantly, creating premium advisory opportunities for FIG bankers who can navigate the multi-jurisdictional landscape.