BaFin publishes expectations on minimum number of directors under German Securities Institutions Act (WpIG)

RegCORE – Client Alert | German Regulatory Developments

QuickTake

On 11 September 2024, Germany’s Federal Financial Supervisory Authority (BaFin) published an Information Sheet (Merkblatt) (01/2024 (WA))Available, as at the time of writing hereof, available only in German here.Show Footnote specifying its expectations when a securities institution (WpIG Firm) must appoint at least two people as its management i.e. as managing directors (Geschäftsführer). 

The Information Sheet, which is applicable and in force from the date of its publication, is addressed to all WpIG Firms that hold a WpIG license as well as to WpIG Firm license applicants or those seeking an application for an extension of a license from the date of publication of this Information Sheet. The Information Sheet was previously consulted on between 17 January 2024 to 18 March 2024 and subtle yet important changes have been made between the consultation and final versions. 

As discussed in this Client Alert, while the Information Sheet serves to clarify BaFin’s (long-standing) expectations in its supervisory approach to the WpIG (which transposed the EU’s IFR/IFD regime), as amended,The WpIG itself serves to reinforce the EU’s Investment Firms Regulation (IFR) and Investment Firms Directive (IFD) (each as amended) as applicable under German law.Show Footnote the contents should be viewed as a noteworthy reminder for a range of WpIG Firms or those seeking to BaFin authorisation to operate as such. 

Moreover, while not specifically identified in the Information Sheet, the contents and in particular BaFin’s expectations may be of importance to those firms that engage in crypto-asset activity that would not be regulated under MiCAR but instead require a WpIG Firm license i.e., for crypto-assets that are categorised as securities and thus fall under “traditional financial services legislation”, which in Germany, includes the WpIG.

Key takeaways from BaFin’s Information Sheet

The Information Sheet sets out criteria which, if met, require a WpIG Firm to have at least two managing directors (Geschäftsführer) in order to meet the legal requirements regarding the professional suitability, competence and availability of the management as well as the organisation of a WpIG Firm pursuant to Section 20 (1), (2) WpIG and Section 41 WpIG.

As with all national competent authorities (NCAs) in the EU, BaFin, in following EU law, assesses professional suitability of management both individually but also as a whole, ensuring that the directors collectively possess all necessary knowledge, skills, and experience to meet their overall responsibility for proper business organisation and associated requirements.

In the consultation paper version of the Information Sheet reference was made to EU law that an IFR/IFD firm must generally (grundsätzlich) have two managing directors. This reference was removed in full in the final Information Sheet thus making this requirement of having at least two managing directors more definitive in how BaFin will apply this standard.As noted by BaFin: “With this Information Sheet, BaFin is also implementing a recommendation of the European Securities Markets Authority (ESMA). ESMA recommends higher content requirements according to which the management of an investment firm with only one manager should be possible. ESMA further recommends that specific and effective materiality thresholds for alternative arrangements are set when an institution is headed by only one manager.”Show Footnote

Equally, both the consultation paper and final version of the Information Sheet set out “risk criteria for the necessity of appointing two managing directors.” A key difference, as with the above, turns on the deletion of the adverb “generally” or “usually” from the text of the Information Sheet. The consultation paper version stated that the risk criteria “usually” (in der Regel) require an evaluation of the below bullet points whereas in the final Information Sheet this adverb was removed i.e. this evaluation is more definitively required:

1. “Reach” (Reichweite) of the WpIG Firm; and/or 

2. Complexity of the WpIG Firm’s business model.

The BaFin considers that potential risks should be limited by the fact that a WpIG Firm is managed by at least two managing directors by enabling the implementation of consistent separation of functions and corresponding mutual controls up to the level of the management. BaFin also assumes that there is a broader basis in terms of professional suitability with two managing directors. Furthermore, BaFin considers that the complexity of certain business models, but also their scope, requires a minimum amount of time that cannot be adequately fulfilled by one managing director.

In both the consultation paper and the final version of the Information Sheet, BaFin concludes that it will consider that large and medium-sized WpIG Firms and small WpIG Firms will meet the criteria of having reach and complexity in its business model in case the following situations (non-cumulative) exist:

a.    High number of “clients” within the meaning of Section 67 (3) WpHG: At least 1,000 private clients; 

b.    Branches abroad or cross-border business: at least one notification pursuant to cross-border services and cross-border branch passporting has been notified; 

c.    Product features: The main object of the business model/provision of investment services relates to products which, according to the specifics of a target market definition, are intended for clients with advanced knowledge and/or experience of financial products. BaFin sets the following as examples (which also raises unanswered questions in light of BaFin’s wide discretion):

i.    Index Certificates on Non-standard Indices;
ii.    Capital Protection Certificates;
iii.    Structured Bonds;
iv.    Credit-linked Bonds;
v.    Reverse Convertibles;
vi.    Discount Certificates;
vii.    Express Certificates;
viii.    Bonus Certificates;
ix.    Outperformance Certificates;
x.    Sprint Certificates;
xi.    Total Return Funds;
xii.    Absolute Return Funds; and
xiii.    Structured UCITS.

d.    Operation of a multilateral trading facility (MTF) or an organised trading facility (OTF); and

e.    Connection (Anbindung) to a large number of “contractually bound intermediaries” (vertraglich gebundener Vermittler) i.e. including but not limited to tied agents and appointed representatives. BaFin presumes a large number to exist “from 50” (ab 50) such (natural/legal) persons. 

In addition to the above, both the consultation and final version of the Information Sheet clearly set out that, in accordance with Section 18 (1) No. 8 WpIG, BaFin may refuse i.e., deny authorisation to an applicant pursuant to Section 15 (1) WpIG in the following cases if the applicant does not have at least two directors who are permanent i.e., not only acting on a voluntary basis for the applicant.

Moreover, the specific conditions for denial of an authorisation are applied by BaFin where the applicant WpIG Firm intends to:

(a)    provide investment services or ancillary investment services with respect to custody and safekeeping and the WpIG Firm being authorised to acquire ownership or possession of customer funds or securities; or 

(b)    be authorised in accordance with a certificate issued by the BaFin to Section 4 (1) No. 2 of the Act on the Certification of Retirement Provision Contracts, to offer retirement provision contracts.

BaFin makes it clear that these specific conditions for denial of authorisation apply regardless of other factors. Irrespective of the above, the Information Sheet reminds readers of the BaFin’s uniform criteria for the professional suitability and availability of managing directors, as well as the proper and suitable organisation of a WpIG, which are generally only met if the WpIG has at least two managing directors.

Outlook and next steps

While it may be tempting to conclude that compliance with the Information Sheet is satisfied in full where there are at least two managing directors appointed for a WpIG Firm, the publication does open the door to supervisory scrutiny of whether (i) those managing directors meet (on an on-going basis) the individual and collective fit and proper (including time commitment) standards applicable to them and (ii) the WpIG Firm’s organisation is set up in a proper and suitable manner conducive to its risk profile. Some of those requirements and considerations for firms are set out in detailed Client Alerts available from our EU RegCORE.

WpIG Firms will also want to ensure that they remain cognisant of how their individual and broader activity, in particular when acting together with affiliated firms, may be viewed in line with risk criteria set out in the Information Sheet and the level of supervisory scrutiny that may attract to its managing directors as well as more broadly i.e., beyond the standards set in the Information Sheet. This is particularly important as the BaFin and other EU NCAs as well as EU-level authorities step up their evaluation of and expectations in firms enhancing their governance, compliance and risk management across securities and investment firms operating in traditional as well as other asset classes (including but not limited to crypto-assets).

It should equally be noted that finding, securing and retaining suitable managing directors (in particular with the required experience and professional qualifications), whether in the German market or the broader EU market, requires time and patience given that for some WpIG and/or IFR/IFD firms competition might be fierce in securing the correct fit in profile for a respective role.

About us

PwC Legal is assisting a number of financial services firms and market participants in forward planning for changes stemming from relevant related developments. We have assembled a multi-disciplinary and multijurisdictional team of sector experts to support clients navigate challenges and seize opportunities as well as to proactively engage with their market stakeholders and regulators.  

Moreover, in addition to AI-powered solutions focusing on contractual repapering to meet DORA compliance we have developed a number of RegTech and SupTech tools for supervised firms. This includes PwC Legal’s Rule Scanner tool, backed by a trusted set of managed solutions from PwC Legal Business Solutions, allowing for horizon scanning and risk mapping of all legislative and regulatory developments as well as sanctions and fines from more than 1,500 legislative and regulatory policymakers and other industry voices in over 170 jurisdictions impacting financial services firms and their business.  

Equally, in leveraging our Rule Scanner technology, we offer a further solution for clients to digitise financial services firms’ relevant internal policies and procedures, create a comprehensive documentation inventory with an established documentation hierarchy and embedded glossary that has version control over a defined backward plus forward looking timeline to be able to ensure changes in one policy are carried through over to other policy and procedure documents, critical path dependencies are mapped and legislative and regulatory developments are flagged where these may require actions to be taken in such policies and procedures.   

The PwC Legal Team behind Rule Scanner are proud recipients of ALM Law.com’s coveted “2024 Disruptive Technology of the Year Award”. 

If you would like to discuss any of the developments mentioned above, or how they may affect your business more generally, please contact any of our key contacts or PwC Legal’s RegCORE Team via de_regcore@pwc.com or our website.