how do I explain to the bank how our company structure with subsidiaries works
The question about group structure comes from KYC, not from CSRD
The bank usually asks this in the context of customer due diligence (KYC — "know your customer"), and it concerns three things: who is the parent company, which subsidiaries fall under the group, and who has ultimate control (UBO — "ultimate beneficial owner"). This is different from the group consolidation that appears in sustainability reporting: the bank wants to know who decides about what, not which entities fall within a CSRD scope. The answer thus consists of an organizational chart or a list of entities, with for each entity the statutory name, the country of establishment and the percentage of shareholding or voting rights.
Where that comes from a single chain file: the legal name of the company, the registration number and the countries where establishments are located are precisely the fields that the bank wants to see per entity. For a subsidiary in another country, that local registration number is needed, not only that of the parent company. If a subsidiary is still missing from the file, then "no, not yet complete" is a more honest answer than filling in a structure that is incorrect — the bank will follow up in case of doubt, and an incomplete organizational chart is more noticeable than a missing answer.
Trade register is the source, not the bank itself
The basis for this question is the Trade Register Act 2007: it sets out which data of an enterprise are recorded, including the legal form, directors and — in the case of a group structure — the relationships between parent and subsidiary companies. The bank does not test anything new here, but asks for confirmation of what is already registered with the Chamber of Commerce, supplemented with UBO information that does not always fully appear from the trade register. A recent extract per entity is therefore the most direct evidence; in a structure with multiple countries, it is advisable to also have the foreign registrations at hand, even if there is no fixed source for that in this file.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.