bank wants to see an organizational chart of our holding and subsidiaries
Group structure is part of client due diligence, not risk assessment
The bank usually requests the organizational chart as part of client due diligence: it needs to know who is behind the business, who the ultimate beneficial owners are, and how control flows within the group. This is not a question about sustainability or cybersecurity, and not a credit assessment of the business itself — it concerns the origin of funds and control. A holding with multiple subsidiaries, a joint venture, or shareholders in another country make the structure less straightforward for the bank than a simple private limited company, and then the bank wants to see the diagram in black and white rather than reconstructing it from separate answers.
Often the same question is also implicitly asked through separate fields: in which countries does the company have operations and under what registration number is the company registered. An organizational chart answers those questions in one picture: it shows the parent company, the subsidiaries, and the percentages or voting rights between them. If you don't have a current diagram, an extract from the Business Register with the corresponding Chamber of Commerce registration numbers of each group entity is often a workable interim solution, although that does not always replace the complete overview the bank is asking for — that depends on the bank.
Derivable from the Business Register Act, not from a sustainability framework
This question is separate from the CSRD, the VSME standard or NIS2: these frameworks concern reporting and security, not ownership and control within a group. The basis for the organizational chart lies in the data recorded for each business according to the Business Register Act 2007 — from this it is possible to determine which entities exist, who the managers are and how they are legally connected to each other. For drawing up a diagram, that register is usually the best starting point, even though it does not provide a ready-made organizational chart.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.