The financial sector in Germany and in Europe has undergone significant changes in recent years and the regulatory environment continues to evolve. Recent developments can be attributed to a multitude of economic, pandemic, political and technological factors. In the aftermath of the financial crisis in 2008, the regulatory regime applicable to banks, investment firms and financial markets in general has tightened globally, resulting in stricter capital, liquidity and prudential requirements. In this regard, financial regulation in Germany is significantly influenced and shaped by the law of the European Union (EU), which actively participates in the development and implementation of international regulatory standards for credit institutions within the Basel Committee on Banking Supervision (BCBS) accounting for a significant part of the global regulatory framework.
The COVID-19 pandemic induced the European financial supervisory authorities to adopt various measures aimed to accommodate the particular challenges that banks have been confronted with and to protect the stability of financial markets and the financial system that are gradually being phased out. In the wake of the Russian invasion of Ukraine in 2022, the German sanctions regime has been significantly extended to improve the enforcement of sanctions and prevention of money laundering. Other current issues include, among others, inflation and the risk of price corrections on financial markets and in real estate.
Aside from that, recent changes in the German financial sector result, among others, from the EU sustainable finance strategy, which aims to support the financing of the transition to a sustainable economy and reduce the greenwashing phenomenon. Beside the EU regulations on disclosures and taxonomy, the EU sustainable finance package and related legislative and regulatory proposals and amendments, various analysis, reports, Q&As and/or guidance notices have been published both at the EU and the domestic level. At the same time, institutions from the financial sector are challenged with incorporating environmental, social and governance (ESG) standards in their processes and products.
Increased digitalisation in the financial sector has found its reflection in several recent and upcoming regulations concerning matters such as cryptoassets, securities dematerialisation, anti-money laundering (AML) and cyber resilience. In recent years, the financial sector has also been impacted by the withdrawal of the United Kingdom (UK) from the EU, which led to the UK becoming a third country from a regulatory perspective. Therefore, the “EU passport” regime, which allows institutions seated in a Member State of the European Economic Area (EEA) to conduct regulated business in other EEA Member States without the requirement to obtain an additional local licence in the host state (and vice versa), is no longer available for UK banks.
Banks and other financial institutions operating in Germany are subject to financial supervision at an EU and/or a national level. At the EU level, the competent regulators are the European Central Bank (ECB) and the European supervisory authorities including the European Banking Authority (EBA), the European Securities and Markets Authority (ESMA) and the European Insurance and Occupational Pensions Authority, each with specific competences. Even though the European supervisory authorities have only, under very exceptional circ*mstances, direct supervisory powers vis-à-vis financial institutions, they significantly influence financial regulation by developing technical and implementation standards, guidelines and recommendations applied by supervisory authorities and the financial institutions that are subject to supervision. At the national level, the banking regulators in Germany are the Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, BaFin) and the German Central Bank (Deutsche Bundesbank, Bundesbank), which closely cooperate for the supervision of financial institutions in Germany.
The Single Supervisory Mechanism
The allocation of competences among the ECB and the national competent authorities (NCAs, i.e. BaFin and Bundesbank in Germany) results from the rules of the Single Supervisory Mechanism (SSM) established for the EEA (i.e. not necessarily for all EU Member States – which do, however, have an opt-in right) in 2014. Those rules have been set out in two key EU regulations: ECB Regulation (EU) No. 468/2014 (SSM Framework Regulation); and Council Regulation (EU) No. 1024/2013 (SSM Regulation). The SSM, however, provides for the allocation of responsibilities only with respect to the supervision of credit institutions within the meaning of Regulation (EU) No. 575/2013 (CRR, as amended, in particular by Regulation (EU) No. 2019/876 – CRR II). Such credit institutions include institutions engaged in the lending and deposit-taking business and, since 26 June 2021, investment firms dealing on own account, engaged in the underwriting of financial instruments and/or placing of financial instruments on a firm commitment basis, whereby, in the case of the investment firms, an additional quantitative pre-requisite applies: the investment firms engaged in the aforesaid businesses are considered CRR credit institutions if the total value of their assets on a solo basis or, subject to further conditions, on a group consolidated basis is equal to or exceeds €30 billion. Otherwise, NCAs are responsible for the supervision in any event.
Within the SSM, a distinction should be drawn between significant institutions and less significant institutions. Institutions are only captured by the SSM if they meet the criteria specified in the SSM Regulation. Institutions are significant if they meet, in particular, any of the following criteria:
- they have a total value of assets over €30 billion or over 20% of the GDP of the EU Member State of establishment, but not less than €5 billion;
- upon a decision of the ECB based on an NCA’s notification (in Germany: BaFin);
- they are one of the three most significant credit institutions in an EU Member State of the euro area; and/or
- public financial assistance has been requested or received directly from the European Financial Stability Facility or the European Stability Mechanism.
Significant institutions are subject to the direct supervision of the ECB insofar as they perform the duties that an NCA would otherwise have to fulfil. The relevant NCA, however, is as involved in the daily supervision as the ECB by allocating members to the Joint Supervisory Team that is formed for each significant institution.
With respect to less significant institutions, ECB supervision is primarily of an indirect nature, as such institutions are generally supervised by NCAs. The ECB’s part in the supervisory process for less significant institutions is therefore generally limited to the issuance of regulations, directions and guidance for NCAs (such as BaFin) as well as monitoring the national supervisory practice. However, there are a few exceptions from this general rule. In particular, within the SSM, the ECB has the exclusive competence to grant and withdraw banking licences, and to object to the acquisition of a qualifying holding, in each case with regard to significant and less significant institutions. Matters such as consumer protection or money laundering do not fall within the competence of the SSM.
BaFin and Bundesbank
BaFin supervises not only less significant credit institutions but also other financial institutions providing financially regulated services such as, for instance, banks conducting lending business but not taking deposits from the public, investment firms that are not significant credit institutions, factoring and leasing firms, payment services institutions, insurance companies, and asset management firms. In addition, BaFin is responsible for combatting money laundering and terrorism financing as well as collective consumer protection in the financial sector. Bundesbank closely cooperates with BaFin in performing the supervisory function, which is effectively a joint task.
Key regulations
The core regulations applicable to banks and investment firms in Germany are laid down in the following laws and rules: the Banking Act (KWG); the Securities Institutions Act (WpIG) implementing Directive (EU) No. 2019/2034 on the prudential supervision of investment firms (IFD); CRR/CRR II, as amended; Directive (EU) No. 2013/36/EU (CRD IV)), as amended, recently by Directive (EU) No. 2019/878 (CRD V) and as implemented into German law; Regulation (EU) No. 2019/2033 on the prudential requirements of investment firms (IFR); the Securities Trading Act (WpHG); and Directive No. 2014/65/EU on markets in financial instruments, as implemented into German law, as well as various EU regulations implementing this Directive (together, MiFID II). Further regulations that are also key for financial institutions but address rather specific topics can be found in so many German acts that only a few of them are highlighted in the following.
KWG and WpIG
Authorisation requirements for banking business, investment services and other financial services in Germany are included in KWG and WpIG. As a general rule, anyone who intends to conduct banking business or provide investment or financial services in Germany, commercially or on a scale that requires commercially organised business operations, needs written authorisation from the supervisory authority. Thus, the definition of banking business and of investment and financial services is of the utmost importance to determine whether a certain activity is subject to a licence requirement under German law.
KWG defines various types of banking businesses and other financial services, whereas investment services are defined both in KWG and in WpIG. Banking business includes, for instance, credit, deposit, guarantee, principal broking, securities custody and underwriting business. Investment services comprise, in particular: investment broking; investment advice; trading in financial instruments as a service for others as well as by using high-frequency algorithmic trading techniques; the operation of a multilateral trading facility; and portfolio management. Other financial services include leasing, factoring and, since 2020 and 2021, respectively, crypto custody business and crypto securities registration services. Trading in financial instruments on one’s own account and behalf may also be subject to a licence requirement if it is performed in addition to banking and/or financial services, or – subject to certain exceptions that are particularly relevant for firms having their seat outside of Germany – if such proprietary trading is being conducted as a member or participant of an organised market or multilateral trading facility, or with direct electronic access to such trading venues. Further, proprietary trading in commodity derivatives and emission allowances might also be subject to a licence requirement, unless one of the available exceptions applies. As regards the relation between the provisions of KWG and WpIG, investment services, including the respective authorisation requirements for their conduct, are regulated by WpIG, unless the investment firm, on a solo or on a consolidated basis and subject to certain conditions, exceeds the monthly average of the total assets of €30 billion and engages in underwriting, dealing on own account or proprietary trading.
Generally speaking, all banks, financial institutions and investment firms operating on the German market may be subject to a licence requirement under KWG or WpIG. However, credit institutions, investment firms and other financial institutions from other EU/EEA Member States may provide cross-border services or establish branches in Germany without an additional licence from BaFin within the framework of the EU passporting regime. This applies to the extent that: an institution holds a valid licence in its home Member State; an institution is supervised by the competent supervisory authority in line with the EU requirements; the relevant business operations are covered by the licence obtained in the home Member State; and entering the German market was preceded with a notification procedure informing BaFin of the contemplated market access. The licensing requirement does not necessarily require that a service provider has a physical presence in Germany. It is sufficient that a service provider targets the German market in order to offer banking products or investment and/or financial services repeatedly and on a commercial basis to companies and/or persons having their registered office or ordinary residence in Germany. Consequently, a licence requirement is not triggered if a foreign financial institution provides a regulated service so long as the service was requested by a German client with no solicitation or targeting by the foreign bank (i.e. no directed marketing or setting up of a German language website) – the so-called reverse solicitation exemption or reverse enquiry regime. In certain exceptional cases, BaFin may exempt a foreign bank from the licensing requirement in Germany if such a bank is effectively supervised in its home country in line with appropriate international standards, and the competent supervisory authority effectively cooperates with BaFin.
A further exception from the general licence requirements has been introduced by MiFID II but has not yet become relevant in practice. Under Regulation (EU) No. 600/2014 (MiFIR), firms in a non-EEA Member State may offer investment services on a cross-border basis to certain categories of customers that do not appear to need a high level of protection (i.e. professional customers and eligible counterparties), provided that the firm has been registered in a special EU register maintained by ESMA. Such registration depends on an equivalence decision of the EU Commission determining that the firms authorised in that third country comply with legally binding prudential and business conduct requirements that have equivalent effect to the requirements under EU law and that the legal framework of that third country provides for an effective, equivalent system for the recognition of investment firms authorised under third-country legal regimes. The IFR has further extended the scope of requirements applicable to this special exemption regime under MiFIR; among others, the requirements for the adoption by the EU Commission of the equivalence decision have been extended so that third-country firms shall comply with prudential, organisational and business conduct requirements that have equivalent effect to those set out in CRR, CRD IV/V, IFD and IFR. At the same time, Member States may allow third-country firms to provide investment services for eligible counterparties and professional clients where no aforesaid equivalence decision by the EU Commission has been adopted or where such a decision has been adopted but is either no longer in effect or does not cover the services or activities concerned.
The process of obtaining a licence in Germany requires an application and the submission of numerous documents, such as: a viable business plan; evidence of meeting capital adequacy requirements; detailed information on liquidity and risk management, organisational structure and internal control procedures; adequate staffing and technical resources; and an adequate contingency plan, in particular for IT systems. Further, the application for a licence must also include information and documents indicating that the members of the management board and the supervisory board (Germany follows the two-tier system for corporate governance purposes) are eligible for such positions, as well as information and documents on qualified holdings (i.e. 10% of capital and/or votes held directly or indirectly, or exerting significant influence by other means).
Aside from the licence requirement, a recent amendment to KWG following the implementation of CRD V into German law introduced a requirement to obtain a written approval by (EU) (mixed) parent financial companies to ensure compliance with prudential requirements on a consolidated and semi-consolidated basis.
In addition, KWG and WpIG include general requirements on the business organisation and constitute the legal basis for various supervisory actions that BaFin and Bundesbank may take.
CRR/CRR II/IFR
CRR/CRR II include, in particular, capital and liquidity requirements for credit institutions, limitations on large exposures and rules on the leverage ratio, i.e. the limitation of indebtedness. Prudential requirements under CRR/CRR II apply also to larger systemic investment firms. These include investment firms dealing on own account and/or engaged in underwriting of financial instruments and/or placing of financial instruments on a firm commitment basis if its consolidated assets are equal to or exceed €15 billion or if the investment firm is part of a group in which the total value of the consolidated assets of all undertakings in the group that engage in the relevant activities is equal to or exceeds €15 billion. In addition, following the implementation of IFD, BaFin may decide to apply the CRR/CRR II prudential regime to an investment firm, dealing on own account and/or engaged in underwriting of financial instruments, whose total value of the consolidated assets is equal to or exceeds €5 billion provided that certain further conditions are met, such as the investment firm carries out those activities on such a scale that the failure or the distress of the investment firm could lead to systemic risk. IFR provides for various prudential requirements, including in relation to own funds, capital, concentration risk, liquidity and related reporting applicable to the investment firms, unless the CRR/CRR II regime applies. In addition, small and non‐interconnected investment firms that do not meet specific thresholds defined in IFR benefit from simplified requirements.
WpHG/MiFID II
WpHG includes, in particular, rules of conduct and organisational requirements for the offering of investment services. Due to the implementation of MiFID II into German law, WpHG was completely revised and does not contain all these rules and requirements in detail, but refers partly to various delegated regulations promulgated under MiFID II at the EU level. WpHG/MiFID II include, for instance, rules on inducement in connection with the provision of investment services, cost transparency, requirements on the recording of correspondence with customers, product governance rules, etc. Further, WpHG contains a licence requirement for certain markets in financial instruments from outside the EEA that allow traders in Germany direct electronic access to the trading venue. Finally, WpHG contains various capital market rules such as, for instance, the voting rights notification regime, restrictions on short selling, and certain disclosure obligations.
Other key regulations
Other key regulations affecting the financial sector in Germany include:
- The Capital Investment Code (KAGB): Particularly addressing the licensing requirements applicable to investment fund managers (including passporting options), categorising various types of funds and setting out the requirements on their asset allocation and their investors as well as including restrictions for the distribution of fund units.
- The Payment Services Supervision Act (ZAG): Particularly addressing the licensing requirements in connection with providing payment services and issuing e-money, including organisational requirements and rules of conduct for payment institutions as well as for other institutions providing payment services (e.g. obligation to grant access to an account via an API, strong customer authentication, IT security requirements).
- The Money Laundering Act (GwG): Including the obligations aimed at combatting money laundering and terrorism financing.
- The Recovery and Resolution Act (SAG): Implementing the EU Banking Recovery and Resolution Directives (EU) No. 2014/59/EU (BRRD) and (EU) No. 2019/879 (BRRD II) and which includes, for instance, the requirement to prepare recovery and resolution plans and the instruments of the regulators in case of a default of a systemically important credit institution.
- The Remuneration Regulation for Institutions (InstitutsVergV): Providing for transparent remuneration systems and adequate remuneration in banks and other financial institutions.
- Legislative acts applicable to specific areas of banking business such as, for instance: the Safe Custody Act (DepotG), addressing the requirements for the safe custody of securities; the Stock Exchange Act (BörsG), including rules for stock exchanges and their market participants; and Regulation (EU) No. 648/2012 of 4 July 2012, as amended, on over-the-counter derivatives, central counterparties and trade repositories, which contains directly applicable rules, particularly for trades in derivatives like clearing or notification obligations, and specific requirements for central counterparties.
- Numerous BaFin circulars and guidance notices issued by BaFin or Bundesbank that specify the regulatory obligations, e.g. the Minimum Requirements on Risk Management (MaRisk).
- Numerous guidelines, recommendations, implementation and technical standards of EBA and ESMA.
EU banking packages 2019 and 2021
The EU banking package 2019 (partially in force since June 2019 and June 2021, respectively), as well as the EU banking package 2021, proposed by the Commission in October 2021, are together aimed to finalise the implementation of the international Basel III agreement and the reforms agreed at an international level by the BCBS and the Financial Stability Board as regards a regulatory framework for credit institutions.
The EU banking package 2019 brought about revision of key EU legislation applicable to credit institutions, including CRR, CRD IV, BRRD and the Single Resolution Mechanism Regulation 806/2014 (SRM). It included CRR II, CRD V, Regulation (EU) No. 2019/877 (SRM II) and BRRD II. CRR II and SRM II are directly applicable in the EU Member States, whereas CRD V and BRRD II had to be implemented into national laws. In Germany, the EU banking package has been implemented by the Risk Reduction Act (RIG), in force since December 2020.
Key amendments by the EU banking package include strengthening the financial stability of credit institutions by introducing a binding leverage ratio requirement of 3% of Tier 1 capital (with an option to impose additional leverage ratio requirements at the discretion of the supervisory authorities), an additional leverage ratio requirement applicable to global systemically important institutions (G-SIIs) equal to 50% of the risk-based G-SIIs capital buffer ratio, a reporting requirement concerning the BCBS Fundamental Review of the Trading Book standards including large exposures, exposures to central counterparties, collective investment undertakings, counterparty credit risk and interest rate risk, as well as changes to the large exposures regime. Also, a binding net stable funding ratio (NSFR) of at least 100% and a more risk-sensitive approach to trading in securities and derivatives have been introduced. Small and non-complex institutions benefit from the rules of increased proportionality and have less stringent reporting obligations, including a simplified, less granular version of the NSFR.
In line with CRD V, German law implemented the amendments to the supervisory review and evaluation process (SREP), whereby the additional own funds requirements imposed by BaFin do not have to be met exclusively with Common Equity Tier 1 (CET1) capital. Also, BaFin may provide additional Pillar 2 Guidance (P2G) aimed at strengthening an institution’s resilience in covering its losses in stress periods.
To ensure that prudential requirements are met at the group level on a consolidated basis, the RIG implemented the CRD V requirement of a written approval for (EU) (mixed) parent financial holding companies. BaFin (and other NCAs accordingly) are responsible for ongoing supervision of a group on a consolidated basis if it supervises the relevant parent institution. Further, large financial groups conducting significant activities in Germany (and other EU Member States accordingly) are obliged to set up an intermediate EU parent undertaking if they have two or more CRR credit institutions or investment firms established in the EU with the same ultimate parent undertaking in a third country unless the total value of assets in the EU of the third-country group is not more than €40 billion.
In the area of banking resolution, the EU banking package 2019 introduced new standards on the total loss-absorbing capacity (TLAC) aligned with the minimum requirement for own funds and eligible liabilities (MREL). As such, G-SIIs shall have more loss-absorbing and recapitalisation capacity. The relevant parameters include the risk-based ratio based on risk-weighted assets and the non-risk-based ratio based on the leverage ratio exposure. In addition, a new category of “top-tier” banks has been introduced, generally comprising non-G-SIIs with total assets exceeding €100 billion. Top-tier banks will also be subject to TLAC/MREL requirements. In addition, from 2024, G-SIIs and top-tier banks will be subject to an additional requirement of 8% of total liabilities and own funds to facilitate the bail-in resolution.
The most recent EU banking package 2021, adopted by the EU Commission in October 2021, includes two legislative proposals to amend CRR/CRR II (CRR III) and CRD IV/V (CRD VI); further, it included a separate legislative proposal concerning amendments to CRR/CRR II in the field of resolution (the so-called “daisy chain” proposal), which in the meantime has finally been adopted and entered into force in the form of Regulation (EU) No. 2022/2036. This so-called daisy chain regulation addresses the prudential treatment of G-SIIs with a multiple-point-of-entry resolution strategy as well as methods for the indirect subscription of instruments eligible for meeting the minimum requirement for own funds and eligible liabilities.
The other proposed changes within the EU banking package 2021 concern CRR/CRR II requirements for credit, credit valuation adjustment, operational and market risks and risks resulting from the use of banks’ internal models, the latter by means of introducing the so-called output floor. Amendments to CRD IV/V include provisions on supervisory powers, sanctions, third-country branches as well as ESG risks.
Investment firms package
The regulatory regime for investment firms introduced by IFD and IFR, implemented into German law by WpIG applicable since 26 June 2021, revised the regulatory framework in CRD IV/V, CRR/CRR II, MiFID II and MiFIR. The revised regime differentiates the prudential regime according to the size, nature and complexity of investment firms. Larger, systemic investment firms are now subject to the same prudential regime as CRR credit institutions. Generally speaking, any investment firm that is dealing on own account or engaged in underwriting of financial instruments and/or placing of financial instruments on a firm commitment basis has to comply with the CRR/CRR II rules if its consolidated assets are equal to or exceed €15 billion or if the investment firm is part of a group in which the total value of the consolidated assets of all undertakings in the group that engage in the relevant activities is equal to or exceeds €15 billion. Non-systemic investment firms are split into two groups. The capital requirements for small and non‐interconnected and thus least risky investment firms are set in a new tailored regime, with simpler requirements. For larger firms, a new modus of measuring their risks has been introduced that is based on their business models.
Sustainable finance
ESG and sustainable finance are key trends in the current EU regulatory and supervisory framework. This follows the EU sustainable finance strategy aimed to support the financing of the transition to a sustainable economy. In July 2020, Regulation (EU) No. 2020/852 on the establishment of a framework to facilitate sustainable investment (Taxonomy) entered into force providing for environmental objectives as well as conditions allowing for economic activity to qualify as environmentally sustainable. In 2021, the Sustainable Finance Disclosure Regulation (EU) No. 2019/2088 (SFDR) introduced a definition for “sustainable investment” including investments in economic activities that contribute to an environmental objective (e.g. key resource efficiency indicators on the use of energy, renewable energy, raw materials, water and land, on the production of waste, and greenhouse gas emissions), a social objective (e.g. tackling inequality, fostering social cohesion, integration, and labour relations) or an investment in human capital or economically or socially disadvantaged communities, provided that such investments do not significantly harm any of those objectives and that the investee companies follow good governance practices (i.e. sound management structures, employee relations, remuneration of staff and tax compliance, etc.). SFDR introduced the principle of “do no significant harm” and imposed related transparency requirements on financial market participants on their websites, in pre‐contractual disclosures and marketing communications. In April 2021, the EU Commission adopted a comprehensive sustainable finance package, including a number of amending delegated acts as regards the integration of sustainability factors, risks and preferences into the product oversight, governance requirements, operating conditions and organisational requirements as well as rules on conduct of business and investment advice and the proposal for Corporate Sustainability Reporting Directive (CSRD). The publication of the sustainable finance package was followed by further initiatives, amendments, acts and proposals, including, among others, the proposal for a Directive on Corporate Sustainability Due Diligence, published by the EU Commission in February 2022. Also, the EU banking package 2021, referred to in the paragraphs above, provides for explicit regulations concerning the management and supervision of ESG risks, including within climate stress tests and supervisory reviews.
1 January 2023 marks the start of applicability of the last provisions of Taxonomy and SFDR in respect of the environmental objectives listed in Art. 9 Taxonomy beyond climate change mitigation and climate change adaptation (that is sustainable use and protection of water and marine resources, transition to a circular economy, pollution prevention and control, and protection and restoration of biodiversity and ecosystems) as well as the start of applicability of the regulatory and technical standards of SFDR. CSRD also came into force in January 2023, including sustainability in (consolidated) management reporting and in the auditing requirement. CSRD shall be implemented by EU Member States by 6 July 2024. The new measures apply generally to financial years starting on or after 1 January 2024, 2025 or 2026, depending essentially on the size of the undertaking, and 2028 for reporting concerning third-country undertakings. At the same time, further changes and developments on ESG topics are pending and to be expected.
In Germany, BaFin has published, among others, a guidance notice on dealing with sustainability risks to provide entities supervised by BaFin with guidance on dealing with ESG risks and Q&As to SFDR to address frequent questions on sustainability disclosures. In September 2022, BaFin launched a consultation on the novelisation of MaRisk to include ESG risks in the scope of minimum requirements on risk management by credit and financial institutions. In addition, in November 2022, the draft novelisation of the German Trade Notification Regulation and German Financial Investment Brokerage Regulation was published, addressing sustainability preferences of (potential) clients and the knowledge of sustainability of financial investment products by financial investment brokers.
Digitalisation, crypto, blockchain and artificial intelligence
The financial sector and its regulatory framework are changing dynamically as a result of digitalisation of banking and financial services and the new risks involved. Recent months and years have brought a multitude of regulatory changes, and further changes are on their way.
Under German law, crypto values qualify as financial instruments for financial licencing purposes and since January 2020, conducting crypto custody business falls within the scope of financial services under KWG and requires written authorisation from BaFin if it is conducted in Germany, commercially or on a scale that requires commercially organised business operations. Crypto custody business is defined in KWG as the custody, management and safeguarding of crypto values or private cryptographic keys used to hold, store or transfer crypto values as a service for others. Cryptographic values are digital representations of a value that is not issued or guaranteed by a central bank or a public authority and does not possess a statutory status of currency or money, but is accepted by natural or legal persons as a means of exchange or payment, or that serves investment purposes and can be transferred, stored, and traded electronically. As such, cryptographic values encompass both cryptocurrencies, such as Bitcoin, and investment tokens. Other than the licence requirement, as mentioned in the passages above, German-based institutions and branches engaged in conducting cryptoasset transfers are subject to requirements and duties of care.
As from June 2021, German securities law has been fundamentally modernised by the Act on Electronic Securities (eWpG). The new law introduces electronic securities and is considered a step towards their full dematerialisation. Instruments such as debt securities in the form of bearer bonds and certain shares in special assets funds can now also be issued purely electronically. Pursuant to the eWpG, electronic securities are property objects subject of a right in rem under property laws. Still outside the scope of eWpG, however, are certain financial instruments, particularly company shares and registered bonds. Under eWpG, the issuers may choose whether to issue securities in the form of a certificate or electronically. Under certain conditions, traditional securities in the form of a physical certificate can be subsequently digitised and vice versa. eWpG provides for two types of electronic securities registers, i.e. central securities registers and decentralised crypto securities registers, the latter being typically based on distributed ledger technology (DLT). Central securities registers can be maintained by a central securities depository within the meaning of Regulation (EU) No. 909/2014 (in Germany: Clearstream Banking AG) or, if authorised by the issuer, by a custodian bank. Crypto securities registries can be maintained by the issuers themselves or by other entities, which requires obtaining a licence from BaFin and is subject to regulatory supervision. In June 2022, the Regulation on Crypto Funds Units (KryptoFAV) came into force, allowing units in investment funds or in individual fund classes to be issued in whole or in part as crypto fund units. Crypto fund units are defined as electronic unit certificates that are entered in a crypto securities register. The latter may be kept either by the depositary or by another entity appointed by the depositary and holding the BaFin licence for the maintenance of a crypto securities register. Further specific requirements were outlined in the Regulation on the Requirements as regards the Electronic Securities Registers (eWpRV) in force since October 2022.
At the EU level, in September 2020, the EU Commission published an EU digital finance package along with a digital finance strategy and legislative proposals. Among others, a directly applicable EU-wide regulation on Markets in Crypto-assets (MiCA) has been proposed to provide full harmonisation of cryptoasset services, including a unified regime on transparency, authorisation and disclosure requirements. The initial proposal of this key regulation for cryptoassets has been materially developed since 2021; a provisional agreement between the European Parliament and the Council of the EU was reached in June 2022 and the legislative procedure is expected to be completed in the first half of 2023.
As part of the package, the EU Commission proposed a regulation on a pan-European blockchain regulatory sandbox of DLT, which has been adopted and entered into force as Regulation (EU) No. 2022/858 on a pilot regime for market infrastructures based on DLT. The DLT Regulation lays down requirements in relation to DLT market infrastructures and their operators concerning granting and withdrawing specific permissions to operate DLT market infrastructures along with exemptions and conditions attached to such exemptions, the operation and supervision of DLT market infrastructures as well as cooperation between operators of DLT market infrastructures, competent authorities and ESMA. The DLT Regulation will apply from 23 March 2023 (except for two amending provisions that are already applicable).
Another legislative proposal that has been newly adopted is Regulation (EU) No. 2022/2554 of 14 December 2022 on digital operational resilience for the financial sector (DORA). DORA is a sector-specific regulation for financial entities aimed to prevent and mitigate cyber threats and lays down requirements regarding, among others, information and communication technology (ICT) risk management and incident reporting, digital operational resilience testing, information and intelligence sharing, and measures for the sound management of ICT third-party risk, including in respect of contractual arrangements and the establishment and conduct of the oversight framework for critical ICT third-party service providers. DORA shall apply from 17 January 2025.
In the field of crowdfunding, in November 2021, Regulation (EU) No. 2020/1503 on European crowdfunding service providers for business (ECSPR) came into force in all EU Member States providing a unified EU standard for lending- and equity-based crowdfunding. ECSPR defines “crowdfunding service” as matching of business funding interests of investors and project owners through the use of a crowdfunding platform and which consists of the facilitation of granting loans or placing without a firm commitment basis, as referred to MiFID II, of transferable securities and admitted instruments for crowdfunding purposes issued by project owners or a special purpose vehicle, and the reception and transmission of client orders in relation to those transferable securities and admitted instruments for crowdfunding purposes. Crowdfunding services providers need to obtain an authorisation from the national supervisory authority (in Germany: BaFin) and shall be registered by ESMA in an EU register of all operating crowdfunding platforms. To avoid the risk of market disruptions, the initial transitional period allowing the provision of crowdfunding services in accordance with national laws has been extended by Commission Delegated Regulation (EU) No. 2022/1988 by 12 months, i.e. until 10 November 2023. In Germany, the legislative adjustments relating to ECSPR have been made by the Crowdfunding Accompanying Act (SchwFinBG).
Further, in April 2021, the EU Commission proposed new rules and actions for excellence and trust in artificial intelligence (AI), including a proposal for a regulation laying down harmonised rules on AI. According to the proposal, AI systems provided or used by regulated credit institutions will need to be addressed and documented in such institutions’ internal governance, arrangements, processes and mechanisms set forth in CRD IV/V and the competent supervisory authorities will need to consider these aspects in prudential supervision. The legislative procedure on the proposed AI Regulation is pending.
Prevention of money laundering
The anti-money laundering/combatting the financing of terrorism (AML/CFT) regime has undergone significant changes in recent years and further crucial changes are coming soon. In the past few years, Directives (EU) No. 2015/849 (4AMLD) and No. 2018/843 (5AMLD) have been transposed into German law, which resulted in a complete revision of the GwG. First, 4AMLD strengthened a holistic, risk-based approach in line with the international recommendations of the Financial Action Task Force and brought about a number of changes concerning the customer due diligence process and internal safeguard measures. The revised GwG also introduced an electronic transparency register as a central database on ultimate beneficial owners (UBOs) of companies, trusts and similar entities. Further changes were required to implement 5AMLD, including revision of the transparency register, which has become publicly accessible and shall be fully comprehensive, i.e. directly include all the required information even if such information is retrievable from other publicly accessible, e.g. commercial, registers. Also, the catalogue of the AML obliged entities has been extended so that it includes entities engaged in the crypto custody business.
As regards the most recent key developments, following its action plan for a comprehensive EU AML/CFT policy, in July 2021, the EU Commission proposed a full AML/CFT package consisting of four legislative proposals, including three regulations and one directive. The package includes a proposal for an EU regulation establishing an EU AML/CFT authority in the form of a decentralised EU regulatory agency with direct supervisory powers over some of the riskiest cross-border financial sector obliged entities. Further, an EU regulation has been proposed that is aimed as a single rulebook on matters currently regulated by the EU AML/CFT directives and respective national implementing provisions. The proposed regulation includes more detailed and granular provisions as well as new requirements, e.g. ensuring the inclusion of various types of cryptoasset services providers, crowdfunding services providers, mortgage credit intermediaries and consumer credit providers, that are not financial institutions, among the AML obliged entities subject to the AML/CFT rules. The proposed, sixth AML directive will repeal the current 4AMLD, as amended by 5AMLD, and will include only the provisions that, given their nature, are not appropriate for a directly applicable regulation and instead require national transposition. Further, the package provides for a recast of Regulation (EU) No. 2015/847 on information accompanying transfers of funds (Wire Transfer Regulation, WTR) so that WTR requirements shall apply also to transfers of cryptoassets. In this regard, to ensure the traceability of cryptoasset transfers by the time the scope of the WTR is extended, the German Federal Ministry of Finance has issued a German cryptoasset transfer regulation (CATR), in force since October 2021, which provides for duties of care for German-based institutions and German branches of foreign institutions engaged in conducting cryptoasset transfers. The CATR will cease to apply once the WTR is revised and applies to cryptoasset transfers as per the aforesaid EU Commission’s proposal.
Further, changes to the German anti-money laundering provisions have been introduced to the GwG with the entry into force of the new sanctions regime.
New sanctions regime
The Russian invasion of Ukraine in February 2022 brought about changes in the sanctions regime both at the international level and the domestic level in Germany. Aside from several sets of international sanctions adopted against Russia, Germany adopted two Sanctions Enforcement Acts (SDG I and SDG II) in May and December 2022 aimed to improve the effective enforcement of sanctions and prevention of money laundering. The new measures include the formation of a central federal agency for sanctions enforcement, direct applicability of UN sanctions lists in Germany, the introduction of various administrative measures in respect of investigating and registering the assets of sanctioned persons and partnerships, enhancement of information exchange between authorities involved and data retrieval as well as creation of a whistleblowing agency. Measures concerning holdings in real properties located in Germany include linking detailed information on real properties with the German AML transparency register, the ban on payment in cash, cryptocurrencies, gold, platinum or precious stones in transactions over real properties located in Germany, the obligation for foreign entities to report their holdings in real properties located in Germany to the transparency register as well as, as from 1 January 2026, the obligation for AML obliged entities and notaries to report discrepancies in respect of the allocation of real properties.
Financial market integrity
In the aftermath of the Wirecard insolvency, which is considered to be the result of extensive fraud, financial market integrity has become one of the priorities of the German government. In 2021 and partly in 2022, the Act on Strengthening the Financial Market Integrity (FISG) led to the amendment of several German laws. Key amendments provide for a stricter liability regime for auditors such as increased liability caps; e.g., in the case of auditing capital companies that are credit institutions but are not capital market oriented, €4 million for simple carelessness and €32 million for gross negligence. The liability for intent is not limited. The FISG also introduces a maximum term of 10 years for audit mandates and significantly extends BaFin’s supervisory duties and powers including in respect of regulated companies’ balance sheets. As regards collective consumer protection, BaFin is allowed to make use of “mystery shopping” vis-à-vis regulated entities and engage trained fieldwork customers in order to identify infringements. Further, the FISG introduced stricter regulatory requirements on outsourcing. Outsourcing of critical or important functions is subject to prior notification to BaFin and Bundesbank. This notification requirement applies also to significant changes and serious incidents concerning such outsourcing. Institutions are obliged to maintain registers of all outsourcings of critical and non-critical functions. In the case of outsourcings to third-country firms, the institutions have to contractually ensure that the third-country firm appoints a local agent for the service of process. BaFin is explicitly allowed to issue orders directly vis-à-vis outsourcing firms that are necessary and suitable to remedy infringements. The stricter provisions on outsourcing reflect the EBA guidelines on outsourcing arrangements (EBA/GL/2019/02), which have in the meantime been implemented in BaFin’s published administrative.
As a general rule, institutions must appoint at least two management board members. Management board members and supervisory board members are subject to a fit and proper assessment. Board members are required to be adequately qualified, trustworthy and in a position to dedicate sufficient time to performing their functions properly. To ensure the latter, KWG limits the number of mandates that can be held simultaneously by board members. If no exception (e.g. group privilege) applies, BaFin may consent to one additional mandate to be held in excess of the statutory limits.
Institutions must ensure proper business organisation, in particular, appropriate and effective risk management, including:
- strategies, in particular business strategy aimed at an institution’s sustainable development, and a consistent risk strategy along with processes for planning, implementing, assessing and revising such strategies;
- processes for determining and safeguarding capital adequacy and risk-bearing capacity;
- an internal control system and an internal audit function with rules on the organisational and operational structure, including a clear determination and division of tasks and competences;
- processes for identification, assessment, management and monitoring of risks, a risk-control function and a compliance function;
- an internal audit function;
- adequate staffing and technical and organisational resources;
- an adequate contingency plan, especially for IT systems; and
- suitable and transparent remuneration systems for board members and employees.
Regulatory requirements in connection with governance and internal controls are further specified in various BaFin circulars and guidance notices, in particular the MaRisk and BaFin’s circular no. 10/2017 on Banking Supervisory Requirements for IT (BAIT), both recently amended in 2021 to implement, among others, EBA guidelines on information and ICT risks and security risk management (EBA/GL/2019/04).
Further regulatory requirements as regards business organisation may arise if a financial institution intends to offer investment services (e.g. investment broking or investment advice). In such a case, the additional organisational requirements and rules of conduct set forth, in particular, in WpHG, the delegated regulations promulgated under MiFID II, and BaFin’s circular no. 05/2018 on minimum requirements for the compliance function and further conduct, organisation and transparency obligations (MaComp), may apply.
Capital requirements for credit institutions under German law are based on CRR/CRR II and KWG and, as such, are in line with the final measures of the BCBS – Basel III framework. To that extent, credit institutions operating in Germany have to comply with requirements on capital adequacy, liquidity and leverage ratio.
Capital adequacy
The own funds of an institution may not fall below the amount of initial capital required at the time of its authorisation. Own funds consist of the sum of its Tier 1 and Tier 2 capital. As a rule, CRR/CRR II require institutions to maintain adequate amounts of own funds consisting of CET1 capital ratio (4.5%), a Tier 1 capital ratio (6%) and a total capital ratio (8%). CRR/CRR II specify the requirements for own funds to qualify as eligible capital. CET1 capital includes, in particular, share/stock capital, capital surplus/agio, retained profits, other accumulated income, and reserves.
Requirements for the Additional Tier 1 capital are less stringent than in the case of CET1 capital, but more stringent than for Tier 2 capital. Further details on own funds are set forth in CRR/CRR II and Commission Delegated Regulation (EU) No. 241/2014, supplementing CRR/CRR II with regard to regulatory technical standards for own funds requirements for institutions. As part of the SREP of the institution’s individual capital adequacy, supervisory authorities (BaFin) may ask the institution to hold additional own funds in excess of the default rules under CRR/CRR II. The SREP decision is issued annually and is based on factors such as the institution’s business model, governance, risk, capital, and liquidity.
KWG requires credit institutions to maintain a capital conservation buffer (CCB) of CET1 capital equal to 2.5% of the total risk exposure amount and an institution-specific countercyclical capital buffer (CCyB). The latter is calculated with the use of domestic CCyB of between 0% and 2.5% (in Germany, the domestic CCyB has been increased to 0.75% with effect from 1 February 2022 and the credit institutions are obliged to use this increased domestic CCyB in the calculation of their institution-specific CCyB as from 1 February 2023). Specific requirements apply in case of capital buffers for G-SIIs.
Liquidity
CRR/CRR II provide for a liquidity coverage requirement (LCR), according to which institutions shall hold adequate liquidity buffers to face any possible imbalance in liquidity flows over a period of 30 days. All institutions must invest their funds in such a way as to ensure that adequate funds for payment outflows (liquidity) are available at all times. In addition, CRR II introduced a binding NSFR of at least 100% (with a possibility of a simplified NSFR with the prior permission of the competent authority in the case of small and non-complex institutions) along with related reporting requirements. Detailed liquidity adequacy requirements are set forth in Commission Delegated Regulation (EU) No. 2015/61 with regard to LCRs for credit institutions.
Leverage ratio
Institutions are required to monitor the level and changes in the leverage ratio as well as leverage risk as part of the internal capital adequacy assessment process. As mentioned, CRR II introduced a binding leverage ratio requirement of 3% of Tier 1 capital. For G-SIIs, an additional leverage ratio requirement, equal to 50% of the risk-based G-SIIs capital buffer ratio, applies. The leverage ratio is subject to reporting to the supervisory authorities and taken into account during the SREP. Details on calculating the leverage ratio are included in CRR/CRR II and Commission Implementing Regulation (EU) No. 2021/451 laying down implementing technical standards for the application of CRR/CRR II with regard to supervisory reporting of institutions.
Deposit protection schemes
German law provides for a statutory deposit protection scheme under the Deposit Protection Act (EinSiG) that secures deposits of up to €100,000 per institution and customer, and in certain cases up to €500,000. A compensation event is determined by BaFin if an institution, due to its financial situation, is not in a position to repay due deposits and there is no prospect that it will be able to do so.
In addition to mandatory participation in the statutory deposit protection scheme, many private banks are members of the voluntary deposit protection fund of private banks kept by the Association of German Banks (Bundesverband deutscher Banken), which provides for a higher level of protection than the statutory deposit protection scheme.
Regulatory obligations
Regulatory obligations of credit institutions, financial services institutions and investment institutions are set forth in a number of EU and German laws (KWG, WpIG, WpHG, etc.) and are specified in technical standards, recommendations, circulars and guidance notices of supervisory authorities (e.g. BaFin and the European supervisory authorities). Institutions are subject to extensive reporting obligations vis-à-vis supervisory authorities and information obligations towards their customers. Compliance with regulations must be duly documented and evidenced (e.g. that the recommended securities transaction was suitable for a given customer or, in case of payment services providers, that the payment transaction was authenticated).
Institutions are subject to various regulations in connection with customers’ complaints and must maintain and document internal processes for handling such complaints. At the same time, customers are required to comply with various information obligations towards the institutions so that the latter may fulfil the regulatory requirements imposed on them. Institutions must conduct know-your-customer checks and comply with AML provisions under the GwG, which require them to conduct customer due diligence, identify the UBO and provide information such as name, date of birth, place of residence, nature and scope of ownership interests (including details on shareholding and control) to the transparency register, as well as to monitor the business relationship.
Contractual relationships
Depending on the product or service offered, the rights and obligations of a bank’s customers are regulated in the relevant contract (e.g. loan agreement) and are subject to various provisions of the German Civil Code (BGB) and the Introductory Act to the Civil Code (EGBGB). In addition, banks use various general terms and conditions to define the contractual relationship with their customers. To that extent, the general terms and conditions template provided by the Association of German Banks serves as a point of reference for German banks.
