International Regulatory Considerations for Cross-Border FIG Deals

Introduction

Cross-border financial institution M&A operates in a regulatory environment of extraordinary complexity. A domestic bank merger in the US requires approval from two to four agencies and takes 6-14 months. A cross-border deal involving a US acquirer and a European target can require approvals from ten or more regulators across multiple jurisdictions, each with different statutory mandates, review timelines, and political dynamics. Add divergent capital frameworks (US Basel III Endgame vs. EU CRR3 vs. UK Basel 3.1), different insurance capital regimes (RBC vs. Solvency II), and evolving third-country access rules (CRD VI), and cross-border FIG deals become the most regulatory-intensive transactions in investment banking. For FIG bankers, understanding these layers is essential: the regulatory landscape often determines whether a cross-border deal is feasible before the financial analysis even begins.

Every cross-border FIG transaction requires navigating multiple regulatory bodies, each with distinct review criteria and timelines.

In the US, the Federal Reserve evaluates ownership and control changes for bank holding companies. The OCC supervises nationally chartered banks. The FDIC reviews transactions involving insured depository institutions. The DOJ conducts antitrust review, analyzing deposit market concentration through HHI analysis. For insurance acquisitions, state regulators review Form A change-of-control applications, often in multiple states simultaneously.

In the EU, the European Commission handles antitrust clearance under the EU Merger Regulation. The ECB provides prudential approval for banking transactions. National competition authorities (BaFin in Germany, CNMC in Spain) add a parallel layer of review. In the UK, the PRA leads on prudential review while the FCA evaluates conduct implications.

CFIUS Review

The Committee on Foreign Investment in the United States (CFIUS) reviews foreign acquisitions of US businesses for national security implications. Financial institutions, with their access to sensitive personal financial data, payment systems, and critical infrastructure, routinely trigger CFIUS review. In 2024, CFIUS received 116 declarations (up from 109 in 2023), with 36 subject to mandatory filing. Maximum penalties for non-compliance were raised from $250,000 to $5 million per violation as of December 2024. At least one case resulted in a $60 million penalty for mitigation agreement non-compliance. While CFIUS has not blocked a major bank acquisition in recent years, the review adds 45-90 days to transaction timelines and can impose mitigation requirements (data security protocols, board composition restrictions, operational separation of sensitive functions) that materially affect deal structure.

The practical impact on deal timelines is significant. While US domestic bank deals have compressed to 6-9 months under the current administration's streamlined review approach, cross-border deals routinely take 12-18 months as sequential and parallel regulatory reviews compound. The timeline uncertainty itself becomes a deal risk: market conditions can shift, financing commitments can expire, and competing bidders can emerge during extended review periods.

The three major banking jurisdictions are implementing the final Basel III reforms on different timelines and with different calibrations, creating a period of regulatory fragmentation that directly affects cross-border competitive dynamics and deal analysis.

The EU moved first, with CRR3 taking effect January 1, 2025, introducing standardized credit risk approaches, the FRTB market risk framework (delayed to January 2026), and the output floor phasing in from 50%. The UK postponed its Basel 3.1 implementation from January 2026 to January 2027, designing its own transition mechanisms. The US, under the capital-neutral approach championed by Vice Chair Bowman, is expected to finalize rules in late 2026 with implementation starting in 2027 and a 3-5 year phase-in.

CRD VI, with member state transposition required by January 10, 2026, introduces new rules governing how banks from non-EU countries (primarily US and UK banks post-Brexit) can operate within the EU.

Under the new framework, third-country banks can no longer provide core banking services (deposit-taking, lending, guarantees) on a cross-border basis into the EU without local authorization. They must establish either an authorized EU branch in each member state where they operate or an EU-authorized subsidiary. The authorization requirement for third-country branches takes effect January 11, 2027.

Exemptions exist for interbank and intragroup services, reverse solicitation (customer-initiated requests), and MiFID II-covered investment services. Contracts for core banking services entered before July 11, 2026 benefit from grandfathering provisions. Third-country branches must comply with EU minimum requirements on capital, liquidity, and internal governance, with a "Class 2" status available for firms from countries whose regulatory regimes are deemed equivalent to the EU's.

For US and UK banks with significant EU operations, CRD VI forces a strategic choice: restructure to establish authorized branches or subsidiaries (with the associated capital, governance, and operational costs), or retreat from certain EU banking activities. This structural requirement increases the operating costs of maintaining cross-border banking platforms and adds another layer of complexity to cross-border M&A integration planning.

Cross-border insurance M&A faces its own regulatory complexity. Solvency II requires roughly twice the capital of US RBC for equivalent P&C insurance portfolios, creating material capital headwinds when a US insurer acquires a European target (or structural capital advantages when a European insurer acquires a US business with lower capital requirements).

The 2017 EU-US bilateral reinsurance agreement provides some relief, allowing reinsurance groups operating in both jurisdictions to be subject to worldwide prudential oversight by their home supervisor only. Bermuda and Switzerland are the only jurisdictions recognized as fully equivalent to Solvency II, giving Bermuda-domiciled groups a structural advantage in cross-border insurance transactions.

UK ring-fencing rules (applying to banks holding over £35 billion in retail deposits with material investment banking operations) add another constraint. Recent proposals would allow ring-fenced bodies to operate overseas subsidiaries and branches, but subject to PRA requirements that they not pose material risk to the ring-fenced bank's safety, soundness, and resolvability. For cross-border acquirers, understanding whether a UK target's operations fall within the ring-fence is critical to assessing what activities can be integrated post-acquisition.

Cross-border FIG M&A sits at the intersection of every regulatory topic covered in this section: capital requirements, stress testing, G-SIB surcharge management, insurance capital regimes, and Dodd-Frank's enhanced prudential standards. The regulatory complexity does not eliminate cross-border deal activity, but it raises the execution bar significantly, creating premium advisory opportunities for FIG bankers who can navigate the multi-jurisdictional landscape.