why do I have to provide an organizational chart of my company to the bank
The bank asks about UBOs and control, not about an organizational chart
The bank wants to know who ultimately pulls the strings: which parent companies, subsidiaries and intermediate holdings exist, and who the ultimate beneficial owners are — the UBOs. This is not a request for a nice organizational chart for the annual report, but for a complete picture of the control chain. Banks must record this as part of their customer due diligence, and a group structure with only the name of the operating company provides insufficient information about this.
In practice, the bank asks for this separately from, but alongside, the basic information already included in the company's registration number . A simple private company limited by shares without a parent or subsidiaries can simply indicate this — then the "structure" is one line. If the company has establishments in multiple countries, the bank often also wants to see how these relate to the countries in which the company operates: a subsidiary in another country presents a different risk profile to the bank than a branch.
Where this comes from: the business register as a basis, customer due diligence as the reason
The formal basis for information about legal form, directors and UBOs lies in the Trade Register Act 2007: that register records who represents a company and who stands behind it. The bank does not ask this out of curiosity, but because it is legally obliged to identify its client and understand the control structure before entering into or continuing the relationship. For a supplia file, this means that the answer ideally comes from the same source that is also provided to the business register — not from a separate PowerPoint presentation that happens to be lying around in the financial administration.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.