Search for:
AML & Financial Services Regulatory

Germany: BaFin publishes new rules regarding content and submission of outsourcing notifications

By , and 4 Mins Read

In brief

With a significant delay, the German Federal Financial Supervisory Authority (“BaFin“) has issued detailed rules on the new notification requirement regarding proposed outsourcings introduced in the Financial Market Integrity Strengthening Act (FISG), a law passed on 3 June 2021 in reaction to market failures.

Comments

Not only banks, but also outsourcing providers should take note of the new regime. While it may come as a surprise that the BaFin’s jurisdiction extends to outsourcing providers across the globe if they have German-regulated customers, the burden will increase even more under the recently adopted EU Digital Operational Resilience Act (DORA). In addition, the need for regulated companies to comply with the new extensive notification obligations can be expected to lead to significant delays before outsourcing deals can be closed.

In more detail

Key changes introduced by the FISG

  • Among other rules, particularly those increasing the obligations and liabilities of external auditors, the FISG also introduced an obligation for credit institutions and financial service institutions regulated by the German Banking Act (Kreditwesengesetz) (KWG) to notify the BaFin and the German Federal Bank (Deutsche Bundesbank) of the intent to outsource material activities, the implementation of such outsourcings, material changes thereto, and serious incidents in relation to such outsourcings. The same obligation was also introduced in the Securities Institutions Act (Wertpapierinstitutsgesetz) (WpIG) for investment firms, which entered into force in June 2021.
  • Moreover, the FISG extended the already existing notification obligation for payment institutions and e-money institutions that are regulated pursuant to the Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz) (ZAG) with respect to the intent and implementation of all outsourcings to also include the obligation to notify in cases of material changes and serious incidents relating to material outsourcings.
  • The FISG extended the already existing notification obligation for asset management companies (AIFM) pursuant to the Capital Investment Code (Kapitalanlagegesetzbuch) (KAGB) with respect to the intent and implementation of all outsourcings (not only material outsourcings) to also include the obligation to notify of any material changes (excluding serious incidents).
  • The FISG also introduced statutory powers for the BaFin to take measures directly against outsourcing companies (i.e., the service providers as defined in the relevant laws, i.e., the KWG, the WpIG, the ZAG and the KAGB as well as the Insurance Supervisory Act (that already contained notification obligations for outsourcings)) and information obligations of the outsourcing companies, irrespective of their geographical location.
  • Furthermore, the FISG introduced the obligation on outsourcing companies from non-EU jurisdictions to appoint a service of process agent in Germany.

BaFin now issued ordinances specifying the notification obligations

On 29 November 2022, the BaFin issued and amended ordinances that specify the notification obligations (in particular, the content of such notifications) and state that outsourcing notifications have to be made electronically through the MVP portal. The relevant ordinances include the following: the Notification Ordinance pursuant to the German Banking Act (Anzeigeverordnung), the Notification Ordinance pursuant to the Payment Services Supervision Act (ZAG Anzeigenverordnung), the Notification Ordinance under the Insurance Supervision Act (VAG Anzeigenverordnung zu Ausgliederungen) and the Notification Ordinance under the Capital Investment Code (KAGB-Auslagerungs-Anzeigenverordnung).

The referenced ordinances provide for extremely comprehensive requirements regarding the information that has to be provided with respect to an outsourcing notification, an amendment notification or the notification of a serious incident.

All notices have to be submitted electronically via the MVP portal. It is necessary to register for the MVP portal first before being able to submit outsourcing notifications. The BaFin provides instructions on its website found here.

After BaFin temporarily suspended the obligation to submit outsourcing notifications for credit institutions and financial services providers (that already came into effect on 1 January 2022), BaFin meanwhile stated that this suspension no longer applies and that the institutions that benefited from the suspension have to submit all notifications that were to be made since 1 January 2022 via the MVP portal by 1 March 2023.

Categories:
Author

Dr. Manuel Lorenz joined Baker McKenzie in 1999 and currently serves as Head of German Financial Services Regulatory Practice. Dr. Lorenz has been admitted as a lawyer in Germany since 1991 and in England and Wales since 1996. In addition to his practice, Dr. Lorenz lectures at the Institute for Law and Finance at the Johann Wolfgang Goethe University in Frankfurt am Main.

Author

Manuel Metzner is a counsel in Baker McKenzie’s Frankfurt office. Prior to joining the Firm, Manuel was counsel at a renowned international law firm, where he practiced in the areas of corporate, M&A, capital markets, financing and financial regulatory for almost 20 years.

Author

Subatra Thiruchittampalam is an associate in Baker McKenzie’s Financial Services & Regulatory and Corporate group currently based in Dusseldorf. Prior to joining the Firm's Dusseldorf office, Subatra worked in the Baker McKenzie offices in Frankfurt and Luxembourg and at an international law office and the Public Prosecutor's Office.

Related Posts

Write A Comment