Mind your messaging: Bafin sets new boundaries with landmark order on advertising in public M&A

EU RegCORE Client Alert | German Regulatory Developments

QuickTake

A major European credit institution (the Bidder) is currently pursuing a public takeover offer for the shares of a German listed credit institution (the Target) pursuant to Section 10(1) sentence 1 of the German Securities Acquisition and Takeover Act (Wertpapiererwerbs- und Übernahmegesetz, the WpÜG). In the context of that offer, on 21 April 2026 the Bidder published three advertising posts on social media platforms which were accessible across the entire European Union.Respective materials are available here and here (including a link to the order). The order is issued by BaFin pursuant to § 28 WpÜG, dated 24 April 2026, served via BaFin’s electronic notification and publication system pursuant to § 4f(2) FinDAG, with operative provisions (Tenor) published under § 44 WpÜG. BaFin’s accompanying press release and additional supervisory materials are available on the BaFin website.Show Footnote

These advertisements characterised the Target as neglected (VERNACHLÄSSIGT), uncertain (UNSICHER) and short-term oriented (KURZFRISTIG ORIENTIERT), and included speculative statements about the Target’s economic position.

On 24 April 2026, the German Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht - Bafin)It should be noted that BaFin has recently rebranded its acronym in German and in English to be written as “Bafin”.Show Footnote responded by issuing an order (Bescheid) against the Bidder prohibiting the publication of non-objective and sensationalist advertising in connection with the pending offer.

Bafin determined that the posts were sensationalist (reißerisch) and lacked objectivity (unsachlich) and were capable of improperly influencing the decision-making of the Target’s shareholders. This order, based on Section 28 WpÜG, is immediately enforceable (sofort vollziehbar) but not yet legally final (nicht bestandskräftig), and the Bidder retains the right to challenge it through administrative court proceedings.

Key takeaways

• Speed of action. Bafin issued the prohibition order within three days of the Bidder’s social media posts being published, illustrating Bafin’s willingness to act at speed during live takeover proceedings.
• Broad supervisory reach. Section 28 WpÜG applies across all modern advertising channels—social media, websites and publicly accessible analyst conferences—and not only traditional print or press advertising.
• Substantive equivalence. The prohibition extends beyond specific terms to functionally equivalent (sinngemäß) statements, giving BaFin significant flexibility to police the spirit of the objectivity requirement.
• Multi-regime exposure. Beyond Section 28 WpÜG, regulated firms must navigate parallel obligations under EU Market Abuse Regulation (MAR), EU Markets in Financial Instruments Directive (MiFID II), EU Digital Operational Resilience Act (DORA), EU General Data Protection Regulation (GDPR), the EU Digital Service Act (DSA) and EU restrictive measures regimes when designing takeover communications.
• Governance imperative. Senior management sign-off, structured second- and third-line assurance and board-level oversight of takeover communications are now operational essentials rather than optional good practice.

This is a notable and, in many respects, unprecedented enforcement action by Bafin in the context of a live public takeover offer. As explored in this Client Alert, the order has implications that extend well beyond the immediate situation, touching on advisory liability, market abuse intersections, hostile bid strategy, governance frameworks, cross-border supervisory coordination and the future direction of supervisory enforcement in European takeover proceedings.

The Bafin order: operative provisions

By way of order (Bescheid) dated 24 April 2026, served via Bafin’s electronic notification and publication system pursuant to Section 4f(2) Act Establishing the Federal Financial Supervisory Authority (Gesetz über die Bundesanstalt für Finanzdienstleistungsaufsicht – FinDAG), Bafin imposed the following prohibitions on the Bidder:

• Specific term prohibition (Ziffer 1(i) of the order). The Bidder is prohibited from describing the Target or its subsidiaries (within the meaning of Section 2(6) WpÜG) as VERNACHLÄSSIGT, UNSICHER, or KURZFRISTIG ORIENTIERT on social media platforms.
• Prohibition of equivalent statements (Ziffer 1(ii) of the order). The Bidder is prohibited from making statements that are substantively equivalent (sinngemäß) to the prohibited characterisations in any advertising context, including social media advertisements, website disclosures and publicly accessible analyst conferences.
• General prohibition of disparaging statements (Ziffer 1(iii) of the order). The Bidder is prohibited from making any other statements about the Target or its subsidiaries that present the target’s current economic situation or future prospects in a sensationalist, inflammatory, or non-objective negative manner in any advertising context.
• Temporal scope. The prohibitions apply until the expiry of the acceptance period under Section 16(1) WpÜG, the further acceptance period under  ection 16(2) WpÜG (if applicable) and the sell-out period under Section 39c WpÜG (if applicable).
• Material scope limitation. The prohibitions only apply insofar as the Bidder’s statements are made in connection with the takeover offer (im Zusammenhang mit dem Übernahmeangebot).

Legal basis for the order: Section 28 WpÜG

Bafin’s order is based on Section 28 WpÜG, which empowers the authority to prohibit certain types of advertising in connection with public offers for the acquisition of securities where such advertising may give rise to market abuses or irregularities (Missstände). The provision is designed to ensure that investors are not misled by unclear or deceptive advertising and that all market participants have equal and fair access to accurate information. Bafin may act both to remedy existing irregularities and to prevent future ones. Publication of the order’s operative provisions (Tenor) is made pursuant to Section 44 WpÜG.

Key legal and regulatory implications

Precedent for future takeover offers

This appears to be a highly unusual, if not unprecedented, use of Section 28 WpÜG in the context of a live takeover. It sends a clear signal that Bafin will actively police the boundaries of permissible communications during takeover proceedings, particularly where a bidder seeks to denigrate the target to influence shareholder acceptance. Future bidders should expect heightened scrutiny of any public-facing communications that could be perceived as disparaging the target company.

Scope and reach of Bafin’s advertising supervision

This order demonstrates that Bafin interprets its supervisory mandate under Section 28 WpÜG broadly. The prohibition extends beyond traditional print or press advertising to encompass social media platforms, websites and analyst conferences. This is significant because it confirms that Bafin views modern digital communications channels as falling squarely within the scope of advertising (Werbung) subject to takeover law constraints. Any regulated firm involved in a public offer must ensure that its communications strategy—across all channels—complies with the objectivity and accuracy standards of the WpÜG.

Standard of conduct: Principle of objectivity (Sachlichkeitsgebot)

The order operationalises the principle of objectivity (Sachlichkeitsgebot) in takeover proceedings. Bafin draws a clear line: statements that are sensationalist (reißerisch), inflammatory (plakativ), or that rely more on suggestive force than economic substance are impermissible. This applies not only to the specific terms used (which are expressly prohibited) but also to functionally equivalent formulations, giving Bafin significant flexibility to enforce the spirit of the prohibition even if a bidder attempts to use different language to convey the same negative characterisation.

Implications for hostile and contested bids

This order is particularly significant for hostile or contested takeover scenarios, where bidders have a strategic incentive to publicly criticise the target’s management, strategy, or financial performance in order to persuade shareholders to tender. Bafin’s action makes clear that there are firm limits on how far a bidder can go in disparaging a target, even in an adversarial context. Firms contemplating hostile bids in Germany will need to calibrate their public messaging far more carefully, distinguishing between legitimate factual criticism of the target’s strategy and impermissible sensationalist or suggestive commentary.

Enforcement and sanctions

Intentional or negligent non-compliance with the order exposes the Bidder to administrative fines (Bußgeld). Given that the order is immediately enforceable, any further publication of prohibited content—even pending a legal challenge—would constitute a violation. The combination of immediate enforceability and the threat of fines creates strong incentives for compliance.

Interaction with MAR and market integrity rules

The order raises important questions about the interaction between the WpÜG advertising restrictions and the MAR. Statements characterising a target company’s economic position in a sensationalist or misleading manner during a live offer could also engage the prohibition on market manipulation under Article 12 MAR, particularly if such statements are capable of giving a false or misleading signal about the value of the target’s securities. Firms should therefore consider not only national takeover law but also the parallel EU-level market integrity framework when planning communications strategies.

Cross-border implications and supervisory coordination

The advertisements were accessible across the entire European Union, which raises questions about the interplay between Bafin’s national supervisory powers and the cross-border reach of digital advertising. While Section 28 WpÜG is a provision of German law, the practical effect of Bafin’s order is to restrict the Bidder’s EU-wide advertising activity on platforms operated by a US-based technology company. This underscores the extraterritorial reach of national takeover supervisory authorities when the relevant offer is governed by the WpÜG. Where a bidder is headquartered in another EU Member State and supervised by the European Central Bank (ECB) (via the Single Supervisory Mechanism) and by its home-state national securities regulator, the order also raises questions about cross-border supervisory coordination. It remains to be seen whether the ECB or the relevant home-state competent authority will take any parallel or complementary action, and whether this case prompts further discussion at the European level about the harmonisation of advertising standards in cross-border takeover offers.

Comparative perspective: prior enforcement and equivalent regimes

Bafin has historically deployed Section 28 WpÜG sparingly, with supervisory attention more commonly directed at the completeness of offer documents under Section 11 WpÜG and the timeliness of decisions to launch an offer under Section 10 WpÜG. The April 2026 order is therefore both a notable expansion in the use of Section 28 WpÜG and a clear signal of a more interventionist supervisory stance toward digital communications in live takeovers. Comparable controls exist across other major EU jurisdictions: CONSOB exercises supervisory powers under the Italian Testo Unico della Finanza (TUF) and the Issuers’ Regulation; the Autorité des marchés financiers (AMF) requires that public-offer communications in France be exact, precise and fair under its General Regulation (Articles 231-1 et seq.); the Dutch Authority for the Financial Markets (AFM) supervises bidder communications under the Wet op het financieel toezicht (Wft); and in the United Kingdom, the Takeover Panel polices offer disclosures under the General Principles and Rule 19 of the Takeover Code. The Bafin order therefore aligns with a broader European supervisory direction toward closer scrutiny of bidder communications, even if its particular focus on social media platforms places it at the leading edge of digital-era enforcement.

Adviser and intermediary exposure

Financial advisers, investment banks and communications consultancies acting for bidders should take note that Bafin’s order targets the bidder directly, but the reputational and operational consequences extend to the advisory chain. Advisers who design, approve, or disseminate advertising materials that fall foul of Section 28 WpÜG risk reputational damage and potential regulatory scrutiny of their own compliance frameworks. Firms acting as financial adviser to a bidder should ensure that all marketing and communications materials are subject to formal sign-off procedures that specifically address the objectivity requirements of the WpÜG.

ESG and reputational risk dimensions

For large regulated institutions, an enforcement action of this nature carries significant reputational risk that extends well beyond the immediate legal consequences. Institutional investors and proxy advisers increasingly scrutinise governance and conduct standards, and a finding that a major bank engaged in sensationalist advertising during a takeover could affect broader market perceptions of the firm’s governance culture. This is relevant for any regulated firm that may find itself subject to similar action in future.

Implications for target companies and their boards

The order also has implications for target companies. A target company and its advisers may now point to this regulatory action as evidence supporting their defensive narrative. More broadly, target boards in future contested bids may be emboldened to seek Bafin intervention at an earlier stage if they consider that a bidder’s public communications cross the line into impermissible advertising. This could become an additional tactical tool in contested offer situations.

Potential chilling effect on bidder communications

There is a broader concern that an expansive interpretation of Section 28 WpÜG—particularly the prohibition on statements that are substantively equivalent (sinngemäß) to those expressly prohibited—could have a chilling effect on legitimate bidder communications. Bidders have a recognised interest in explaining the rationale for their offer, which may include candid assessments of the target’s weaknesses. The line between permissible factual analysis and impermissible disparagement is not always clear, and firms may err on the side of excessive caution, potentially reducing the quality of information available to shareholders making tender decisions.

Practical FS legal and regulatory compliance considerations

Immediate considerations

1. Social media governance. Social media requires dedicated protocols, as posts can be drafted and published rapidly without the multi-layered review processes that typically apply to formal offer documents or press releases.
2. Digital channel risk. Social media platforms present particular risks given their wide reach, viral potential and the difficulty of controlling content once published. Content published on social media platforms may be amplified, shared, or screenshotted, making retraction difficult even after an order is issued. Firms should implement clear social media policies for takeover-related communications.
3. Communications governance. All public-facing communications, including social media posts, website content, press releases and statements at analyst conferences, should be subject to rigorous legal review to ensure compliance with the objectivity requirements of takeover law.
4. Tone and substance. Advertising that focuses on the suggestive or emotional impact of statements, rather than on verifiable economic facts, is likely to attract regulatory intervention.
5. Temporal awareness. The restrictions apply throughout the entire acceptance and sell-out period, which may span several months, requiring sustained compliance vigilance.
6. Record-keeping obligations. Firms should ensure that all advertising materials published during a takeover period are properly archived for regulatory audit purposes.
7. Internal compliance frameworks. The order highlights the need for robust internal approval processes for all external communications during a takeover, including content published by marketing or corporate communications teams that may not traditionally be subject to legal or compliance review.

Strategic and governance considerations

1. MAR market abuse controls. Pre-publication review of takeover-related communications should expressly test against Article 12 MAR (market manipulation), Article 15 MAR (prohibition) and Article 20 MAR (investment recommendations). Firms should also reassess Article 17 MAR ad hoc disclosure obligations in respect of any inside information generated by the communications strategy and update insider lists and personal account dealing controls under Articles 18 and 19 MAR for staff involved in drafting or approving advertising.
2. MiFID II marketing communications standards. Investment firms in scope of MiFID II remain subject to the Article 24(3) requirement that all communications be fair, clear and not misleading, supplemented by ESMA’s guidance on the use of social media. These standards apply in parallel to Section 28 WpÜG and may be engaged even where takeover advertising rules are not.
3. Senior management accountability and governance. Under MaRisk (Bafin Circular “Minimum Requirements for Risk Management”, in particular AT 4.3 and AT 4.4) and the EBA Guidelines on internal governance under Directive 2013/36/EU (EBA/GL/2021/05, dated 2 July 2021), the management body of a regulated institution is responsible for ensuring that public communications form part of the firm’s risk management and compliance framework. Firms should document clear sign-off responsibilities at senior management or board level for takeover-related communications, together with escalation pathways and a written allocation of responsibility.
4. Outsourcing and third-party risk. Engagements with external PR, advertising or communications agencies may constitute service arrangements within scope of the EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02, dated 25 February 2019, applicable from 30 September 2019) and, where ICT services are involved, of DORA (Regulation (EU) 2022/2554). Firms should ensure that such engagements are supported by written agreements with appropriate audit, monitoring, due diligence and termination rights.
5. Information and Communications Technology (ICT) and operational resilience under DORA. Social media platforms used for takeover communications are ICT third-party service channels for DORA purposes. Firms should ensure that ICT risk management, incident reporting, scenario testing and exit/contingency arrangements address platform outages, account compromise and content take-down events occurring during a live offer.
6. Whistleblowing channels. Under the EU Whistleblower Directive (Directive (EU) 2019/1937) and the German Act for the Better Protection of Whistleblowers (Hinweisgeberschutzgesetz - HinSchG), regulated firms must maintain internal reporting channels covering breaches of EU and national financial services law, including Section 28 WpÜG and MAR. Firms should ensure that staff identifying potentially non-compliant takeover advertising have a protected route to report it internally and, where appropriate, externally to Bafin.
7. Cross-border supervisory notification and SSM coordination. Significant institutions supervised under the SSM should consider proactive notification to their Joint Supervisory Team and to relevant home and host regulators of (i) the public offer communications strategy and (ii) any enforcement action received. Failure to escalate regulatory enforcement to the lead supervisor in a timely manner can itself constitute a separate governance failing.
8. GDPR and targeted advertising. Paid social media activity involves processing of personal data for targeting, segmentation and retargeting purposes. Firms should ensure compliance with Articles 6, 9, 13 and 14 GDPR, and should also have regard to the restrictions on targeted advertising in Article 26 of the Digital Services Act, particularly where takeover-related campaigns are directed at retail shareholders.
9. Conduct, suitability and retail investor protection. Where the target’s shareholder base includes retail investors, sensationalist messaging may also engage ESMA’s guidance on firms’ use of social media, Bafin’s principles on advertising for financial instruments under Section 9 WpHG and unfair commercial practices law (UWG, implementing Directive 2005/29/EC) where the audience includes consumers.
10. Sanctions and restrictive measures screening. Communications and the platforms used to disseminate them should be screened against EU restrictive measures (including Council Regulation (EU) No 833/2014, as amended), particularly where the bidder, the target, the platform or the audience may have nexus to a sanctioned jurisdiction or counterparty during the offer period.
11. SREP and supervisory dialogue implications. A Bafin order of this kind is the type of qualitative event that may feed into the SREP assessment of governance and conduct, and into the ongoing supervisory dialogue with Bafin, the Bundesbank and the ECB/SSM. Firms should anticipate enhanced supervisory questioning on the control environment that allowed the conduct to occur.
12. Training and awareness obligations. Under the EBA Guidelines on internal governance, regulated firms must ensure ongoing staff training on regulatory obligations material to their role. Communications, marketing, investor relations and corporate development teams involved in takeover situations should receive bespoke training covering Section 28 WpÜG, MAR, MiFID II marketing standards and the firm’s internal sign-off procedures.
13. Independent compliance monitoring and assurance. Beyond first-line internal approval, firms should consider second- and third-line assurance: targeted compliance monitoring of takeover communications during a live offer and a post-event internal audit review of the control environment, in order to demonstrate to Bafin and the SSM that lessons have been embedded.

Outlook

The Bafin order represents a robust and expansive exercise of supervisory authority under Section 28 WpÜG, with implications well beyond the immediate situation. Looking ahead, three forward-looking observations are particularly relevant for regulated firms and their advisers.

Appeal trajectory. The order is immediately enforceable but not yet legally final. The Bidder retains the option of an Anfechtungsklage at the Verwaltungsgericht Frankfurt am Main coupled with an application for the restoration of suspensive effect (Antrag auf Wiederherstellung der aufschiebenden Wirkung). Any such proceedings will set the first judicial benchmark for how courts assess the proportionality of Section 28 WpÜG advertising prohibitions in the digital era and, in particular, the boundaries of the Sinngemäß prohibition. Market participants should monitor this trajectory carefully, as the resulting case law is likely to shape the practical reach of Section 28 WpÜG for years.

Supervisory coordination. It remains to be seen whether the European Central Bank (via the Single Supervisory Mechanism), the Bidder’s home-state securities regulator or other EU competent authorities will take parallel or complementary action, or whether the case is escalated as a matter of cross-border supervisory cooperation. Even absent formal action, the order is likely to feature in the qualitative components of the SREP dialogue with the Bidder’s lead supervisor and could prompt thematic supervisory work on takeover communications across 2026 and 2027.

Implications for the next contested German bid. The order recalibrates the boundary between aggressive but legitimate bidder communications and impermissible disparagement. Future bidders in the German market—and target boards in defensive postures—should anticipate that Bafin will be willing and able to intervene at speed where it considers the Sachlichkeitsgebot to have been breached. For regulated firms, this is a clear reminder that public communications during a live takeover offer are subject to stringent regulatory standards and that Bafin is prepared to act swiftly to protect the integrity of the takeover process and the interests of investors.

About us

PwC Legal is assisting a number of financial services firms and market participants in forward planning for changes stemming from relevant related developments. We have assembled a multi-disciplinary and multijurisdictional team of sector experts to support clients navigate challenges and seize opportunities as well as to proactively engage with their market stakeholders and regulators.  

Moreover, we have developed a number of RegTech and SupTech tools for supervised firms, including PwC Legal’s Rule Scanner tool, backed by a trusted set of managed solutions from PwC Legal Business Solutions, allowing for horizon scanning and risk mapping of all legislative and regulatory developments as well as sanctions and fines from more than 2,500 legislative and regulatory policymakers and other industry voices in over 170 jurisdictions impacting financial services firms and their business. 

Equally, in leveraging our Rule Scanner technology, we offer a further solution for clients to digitise financial services firms’ relevant internal policies and procedures, create a comprehensive documentation inventory with an established documentation hierarchy and embedded glossary that has version control over a defined backward plus forward looking timeline to be able to ensure changes in one policy are carried through over to other policy and procedure documents, critical path dependencies are mapped and legislative and regulatory developments are flagged where these may require actions to be taken in such policies and procedures.   

The PwC Legal Team behind Rule Scanner are proud recipients of ALM Law.com’s coveted “2024 Disruptive Technology of the Year Award” and the “2025 Regulatory, Governance and Compliance Technology Award in 2025”.  

If you would like to discuss any of the developments mentioned above, or how they may affect your business more generally, please contact any of our key contacts or PwC Legal’s RegCORE Team via de_regcore@pwc.com or our website.