Financial Regulation and BaFin Licensing

Financial regulation in Germany: the short answer

Financial regulation in Germany starts with one question: does the activity require a licence? Anyone who conducts banking business or provides financial services in Germany commercially, or on a scale that requires a commercially organised business, needs written authorisation (§ 32(1) of the Banking Act, Kreditwesengesetz, KWG).

Parallel licensing regimes apply to investment firms under the Investment Firms Act (Wertpapierinstitutsgesetz, WpIG), to payment and e-money institutions under the Payment Services Supervision Act (ZAG), to fund managers under the Capital Investment Code (KAGB), to insurers under the Insurance Supervision Act (VAG) and to crypto-asset service providers under the EU Markets in Crypto-Assets Regulation (MiCAR) and the Crypto Markets Supervision Act (KMAG). Conducting licensable business without authorisation is a criminal offence (§ 54 KWG).

Once licensed, institutions are subject to ongoing supervision: capital and liquidity requirements, governance and risk management, outsourcing controls, ICT and operational resilience, reporting, audits, owner control and conduct rules. The supervisors are the Federal Financial Supervisory Authority (BaFin), the Deutsche Bundesbank and, for significant banks in the euro area, the European Central Bank (ECB). This page explains the licensing regimes, the application process, owner control procedures, the core organisational requirements including MaRisk and the Digital Operational Resilience Act (DORA), and how enforcement works.

It is written for banks, investment firms, payment institutions, fund managers and their owners, for companies entering financial services from other sectors, and for foreign firms planning to serve German clients. Fintech and crypto business models are covered in more detail on our page on fintech, payments and crypto assets, and fund regulation on investment funds and asset management.

Licensing regimes under financial regulation

German financial regulation defines licensable activities in detail. The KWG lists banking businesses, such as deposit-taking, lending, principal broking, custody and guarantee business, and financial services, such as investment advice, placement, portfolio management, factoring and finance leasing. Since the WpIG entered into force, most investment firms that are not banks are licensed under § 15 WpIG instead of the KWG, with a proportionate regime based on the EU Investment Firms Regulation and Directive. Payment services and e-money business are licensed under §§ 10 and 11 ZAG, which implement the second Payment Services Directive and the E-Money Directive.

The licensing trigger is often a matter of interpretation. Lending to German borrowers, arranging financing, offering embedded payments in a platform or holding client money may each be licensable depending on the details. BaFin publishes guidance notices on many activities, and businesses can ask BaFin for a binding assessment of whether their model requires a licence. Exemptions exist for certain group-internal activities, for some activities ancillary to a non-financial business and for limited networks and commercial agents in payment services.

Cross-border services into Germany

Firms licensed in another EU or EEA state can provide services in Germany under the European passport, either cross-border or through a branch, after a notification procedure through their home regulator. Firms from third countries, including the United Kingdom since Brexit and the United States, need a German licence or an exemption to conduct licensable business in Germany. BaFin takes the view that cross-border business is conducted in Germany if the provider targets the German market, even without a physical presence, so marketing to German clients from abroad can trigger the licence requirement. Reverse solicitation, where a German client approaches the foreign provider entirely on its own initiative, is narrowly construed.

Alternatives to a full licence

Not every new entrant needs its own licence from day one. Some business models can operate as a tied agent of a licensed investment firm, which assumes regulatory responsibility for the agent's activities, or through a partnership with a licensed bank that provides the regulated service while the partner provides the customer interface ("banking as a service"). Payment services can sometimes be structured to fall within exemptions, for example for commercial agents or limited networks, although these are interpreted narrowly. Each alternative has consequences for control of the customer relationship, economics and liability, and the partner bank will itself be subject to outsourcing and anti-money laundering requirements that shape the contract.

The licence application

A licence application is a substantial project. The applicant must demonstrate adequate initial capital, at least two fit and proper managers (the "four-eyes principle" applies to most institutions), a credible business plan with financial projections for the first years, a proper business organisation including risk management, compliance, internal audit and anti-money laundering functions, an IT strategy and ICT risk framework compliant with DORA, and suitable owners of significant holdings. The documents must show not only policies but also the resources to implement them.

The managers' fitness is assessed on the basis of theoretical knowledge and practical experience in the relevant business, typically including management experience in a comparable institution, and their reliability on the basis of criminal and regulatory records. Members of supervisory bodies must also be reliable and have the necessary expertise. BaFin and the Bundesbank usually hold pre-application meetings and ask detailed questions during the procedure. Realistic timelines range from several months for simpler payment or investment firm licences to considerably longer for full banking licences, which are decided by the ECB.

Owner control and significant holdings

Financial regulation in Germany also covers the owners of institutions. Anyone intending to acquire, alone or with others, a significant holding in an institution must notify BaFin and the Deutsche Bundesbank in advance (§ 2c(1) KWG). A significant holding is a qualifying holding within the meaning of the Capital Requirements Regulation, essentially 10% or more of the capital or voting rights or the ability to exercise significant influence. Further notifications are required when the holding reaches or exceeds 20%, 30% or 50% of the voting rights or capital or when the institution becomes a subsidiary. Similar regimes apply under the WpIG, ZAG, KAGB and VAG.

The supervisor assesses the acquirer's reliability, financial soundness, the source of funds, and whether the acquisition could impair effective supervision or increase the risk of money laundering. For banks in the euro area, the ECB decides on acquisitions of qualifying holdings. Statutory assessment periods apply, and the supervisor can prohibit the acquisition. In M&A transactions involving financial institutions, owner control approval is therefore a condition precedent, and the notification must include detailed information about the acquirer's group, owners and plans.

Buyers should also conduct regulatory due diligence on the target: open findings from audits, pending supervisory measures, the state of the outsourcing and ICT frameworks, and any history of unlicensed activities, because the buyer inherits the institution's regulatory history along with its licence. Our page on mergers and acquisitions explains how such approvals are built into the transaction timetable.

Governance, MaRisk, outsourcing and DORA

Institutions must have a proper business organisation that ensures compliance with legal requirements and business necessities, and the managers are responsible for it (§ 25a(1) KWG). BaFin specifies these requirements in its circular on Minimum Requirements for Risk Management (Mindestanforderungen an das Risikomanagement, MaRisk), which covers risk strategy, risk-bearing capacity, internal control systems, the risk control, compliance and internal audit functions, new product processes and outsourcing. Comparable circulars exist for investment firms, payment institutions and fund managers. The requirements are applied proportionately according to the size, complexity and risk profile of the institution.

Outsourcing of activities and processes that are material for banking business or financial services requires appropriate arrangements to avoid excessive additional risks, and outsourcing must not impair the proper conduct of business, the managers' ability to steer and control, or BaFin's supervisory powers (§ 25b KWG). Outsourcing contracts must include rights of access, audit and instruction, termination rights and exit strategies, and material outsourcings must be notified.

The Digital Operational Resilience Act (Regulation (EU) 2022/2554, DORA), which has applied since 17 January 2025, harmonises ICT risk management across the financial sector. It requires an ICT risk management framework approved by the management body, classification and reporting of major ICT-related incidents, digital operational resilience testing (with threat-led penetration testing for selected entities), management of ICT third-party risk including a register of information on all contractual arrangements with ICT providers, and mandatory contractual provisions. Critical ICT third-party providers, such as large cloud providers, are directly overseen by the European supervisory authorities. DORA has largely replaced the previous German IT-specific circulars for the entities within its scope.

Capital, liquidity and reporting

Credit institutions are subject to the prudential requirements of the Capital Requirements Regulation and the German rules implementing the Capital Requirements Directive: minimum own funds, capital buffers, liquidity coverage and net stable funding ratios, large exposure limits and leverage ratio. Investment firms have their own, more proportionate prudential regime, and payment institutions and fund managers must hold initial capital and own funds calculated by reference to their business. Regulatory reporting to the Bundesbank is extensive and must be produced from reliable data; reporting failures are a frequent finding in audits and a common trigger for supervisory measures.

Conduct of business and client protection

Beyond prudential rules, financial regulation in Germany includes conduct rules that protect clients. Investment firms and banks providing investment services must comply with the MiFID II rules transposed into the Securities Trading Act: suitability and appropriateness tests, product governance, inducement rules, best execution and recording of telephone conversations. Consumer credit and payment services are subject to detailed information duties under the BGB. BaFin's consumer protection mandate allows it to act against practices that harm consumers collectively, and complaints handling is itself a regulated process.

Remuneration and internal governance

Institutions must have remuneration systems that are appropriate, transparent and aligned with sustainable business strategy, with additional rules on variable pay, deferral and clawback for significant institutions and material risk takers. Internal governance requirements also cover conflicts of interest, the composition and work of the supervisory board, and internal whistleblowing channels, which institutions must maintain regardless of headcount.

• Keep the outsourcing register and the DORA register of information consistent.
• Test incident classification and reporting processes before an incident occurs.
• Review cloud and IT contracts for the mandatory DORA clauses, including exit rights.
• Document management body approval of the ICT risk framework and regular reviews.

Supervision and enforcement

Ongoing supervision relies on regulatory reporting, annual audits by external auditors with special reporting on regulatory requirements, supervisory meetings, and special audits commissioned by BaFin. Where deficiencies are found, BaFin can order measures to remedy them, set capital add-ons, restrict business, require the dismissal of managers, appoint a special representative to monitor implementation, and as a last resort revoke the licence. Administrative fines can be imposed on institutions and individuals, and BaFin publishes most final enforcement measures on its website, naming the institution.

Unlicensed business is pursued vigorously. BaFin can order the immediate cessation and winding-up of unauthorised business, including the repayment of client money, and the public prosecutor can bring charges under § 54 KWG, which provides for imprisonment of up to five years or a fine. Managers of companies that conduct unlicensed business can also face civil liability to clients. Anti-money laundering failings are enforced under the Money Laundering Act and are a frequent subject of special audits and fines.

Financial regulation in Germany is increasingly shaped by EU institutions. The EU Anti-Money Laundering Authority in Frankfurt is building up its supervisory functions, and the European supervisory authorities issue technical standards and guidelines that BaFin applies. Firms should follow EU-level developments as closely as BaFin's own publications. For crisis situations involving regulated firms, our page on insolvency proceedings explains the general framework; banks are subject to a separate resolution regime.

For managers, personal accountability is a growing theme. Supervisors expect managers to know their institution's risks, to document decisions and to act on audit findings. Managers who tolerate serious deficiencies risk being removed from office, barred from future positions and, in some cases, prosecuted. Good financial regulation compliance is therefore also personal risk management for the board.

How TRW & Co helps

We advise banks, investment firms, payment and e-money institutions, crypto-asset service providers, fund managers, their owners and new market entrants on financial regulation in Germany. We analyse whether business models require a licence and seek binding views from BaFin, prepare licence applications and owner control notifications, and design governance, risk management, outsourcing and DORA frameworks. We review and negotiate IT and outsourcing contracts for regulatory compliance, support institutions in special audits and enforcement proceedings, and advise on regulatory approvals in M&A transactions. To discuss a regulatory question, please contact us.