## 1deuea2022007 ## Source details **Canonical URL:** [1deuea2022007](https://www.imf.org/-/media/files/publications/cr/2022/english/1deuea2022007.pdf) ## Other formats - [Markdown version](/-/media/files/publications/cr/2022/english/1deuea2022007.pdf.md) - [Structured JSON version](/-/media/files/publications/cr/2022/english/1deuea2022007.pdf.json) --- ### Executive summary and scope - The FSAP conducted a focused review primarily assessing banking regulation and supervision of Germany’s less significant institutions (LSIs). - Germany accounts for 1,324 of about 2,400 total LSIs in the Euro Area (representing 40 percent of Germany’s banking sector assets and approximately 55 per cent of total Euro Area LSI assets). - Regulation and supervision of banks take place within the ECB’s Single Supervisory Mechanism (SSM); BaFin and Deutsche Bundesbank (BBk) are responsible, under ECB oversight, for supervision of LSIs. - Review reflects regulatory and supervisory frameworks as per October 19, 2021. - Progress since 2016 BCP assessment: - Roll-out of the ECB/SSM approach to the SREP to all LSIs. - Enhancements to liquidity risk (roll-out of LCR and related reporting). - Enhancements to operational risk (including on cyber risk). - Expansion of financial accounting oversight powers for BaFin. - Wirecard response and related reforms: - MoF initiated reorganization program including legal and structural reforms impacting BaFin (forensic audit, enforcement of financial reporting quality by external auditors, whistleblower use, consumer protection, center for digital data excellence). - President of BaFin given strengthened internal powers (strategic direction, budget proposal, organization structure, directions to Executive Directors). - Joint modernization project concluded December 17, 2021. - Wirecard Bank did not run into insolvency and is conducting a voluntary wind down. ### Institutional arrangements, independence, and reporting - Key institutional roles and resourcing: - MoF: legal (Rechtsaufsicht) and technical (Fachaufsicht) supervision of BaFin (section 2 FinDAG). - BaFin: federal agency under MoF; national resolution authority (NRA) for LSIs without cross-border operations; total about 2,720 staff, about 550 in the Banking Supervision Directorate (BSD). - BBk: day-to-day (off- and on-site) supervision; about 1,550 staff directly involved in supervision of credit institutions (deployed approx. 33 percent SIs / 67 percent non-SI credit institutions). - SSM/ECB: direct supervision of SIs; oversight and delegated responsibilities for LSIs; authorization of third-country bank branches is responsibility of NCAs. - Reporting and operational independence concerns: - BaFin subject to broad reporting requirements to MoF, covering issues beyond financial stability; MoF “may at any time require BaFin to report… or ask to submit documents.” - Current detail and frequency of communication appear to go beyond necessary oversight and raise questions about BaFin’s operational independence. - Recommendation: streamline and systematize BaFin’s reporting to the MoF (report regularly ex-post, predetermined frequency, aggregate sectoral/cross-sectoral focus; individual file information only as necessary). - Recommendation: elevate responsibility for reporting to office/secretariat of BaFin’s President and reflect newly agreed reporting framework in document describing MoF oversight principles. - Coordination: - Need for a joint BaFin/BBk strategic agenda to avoid duplicative or disjointed efforts (e.g., joint digitalization agenda) and strengthen mid-cycle reporting against supervisory priorities. ### BaFin reorganization program, Focus Units and Task Force - Reorganization workstreams: 1) creation of Focus Units for complex institutions; 2) creation of forensically trained Task Force for special audits; 3) reform of financial reporting enforcement system; 4) closer engagement with market participants and whistleblower follow-up; 5) strengthening consumer protection powers and capacity; 6) strengthening position of BaFin’s President; 7) creation of a central digital data unit; 8) cultural change. - President’s powers (amendments July 2021): - stronger internal powers on strategic direction, budget proposal, organizational structure, ability to give directions to Executive Directors; direct responsibility for Task Force and Focus Units. - Operational rollout: - Pilot phase for banks since May 2021; Go-Live in August 2021 within entire BaFin. - Focus Units and Task Force intended to free capacity for LSIs supervision and create in-house investigative capacity, reducing dependence on external capacity. - Governance considerations: - MoF expected to step back from direct involvement in reorganization program by end 2021; recommended minimizing or eliminating direct MoF interventions in BaFin’s reorganization initiatives. - Full integration and BBk buy-in critical; previously existing joint BaFin/BBk projects (e.g., joint digitalization agenda) had been put on hold. ### Corporate governance, external auditors, and supervisory engagement - Corporate governance gaps: - Dual board system: supervisory board oversight of key control functions needs strengthening (direct reporting lines of internal audit, compliance and risk management). - Current construct leaves room for management boards to dominate essential control functions. - No requirements for independent supervisory board members or independence of the chair; absence of independent members impairs supervisory board’s ability to effectively challenge management. - No requirement for heads of internal control functions to have direct independent access to the supervisory board; KWG requires that management board be informed of such requests. - External auditors (EAs): - German authorities place great reliance on EAs for compliance with MaRisk; supervisors need ability to challenge EA work and perform deep dives (e.g., credit file reviews for related/connected party transactions). - 2020 amendment to section 29(3) sentence 2 of the KWG allows banking supervisor to gain more detailed information from the external auditor. - Recommendation: reassess reliance on EA work; ensure supervisors can challenge and deepen verification (including access to working papers where possible or compensating supervisory capacity). - Supervisory engagement with boards: - Annual discussions generally with management board; engagement with supervisory board is very limited. - Recommendation: increase engagement with supervisory board members (at least two supervisory board members should have increased contact with authorities; suggested contacts include Chairman and Chair of Audit Committee, allow private meetings without management present). ### Supervisory framework, SREP, on-site inspections, resources and dynamics - SREP implementation: - Roll-out of ECB/SSM LSI SREP methodology completed in 2020; German SREP methodology developed along EBA SREP Guideline and ECB’s SSM LSI methodology; SREP score determined annually for each LSI. - SREP drives Minimum Engagement Level (MEL) and minimum frequency for on-site inspections. - Two SREP types: full SREP (includes Pillar 2 capital add-on (P2R)) and summary SREP (updates risk score without reassessing P2R). - P2G assessed/reviewed usually every 2 years. - Identified weaknesses: - MEL currently does not include engagement of management function or risk control functions even for lowest risk assessment score (SREP 4). - On-site inspection frequency requires reassessment: current up to a 4-year cycle for MEL IV high-impact/high-risk LSIs; large LSIs (>EUR15Bn total assets) currently up to 10-year cycle (other text suggests up to 10–12 years for large LSIs and prudence suggests shorter cycles). - Resource constraints: difficulty in fielding on-site inspections at 1–4 year frequency given available resources. - Supervisory resources per LSI (comparative findings): - 0.33 FTE/LSI (lowest ranked out of 21 NCAs); - 0.2 FTE/LSI for savings and cooperative banks; - 2.6 FTE/HP LSI ranked 17th out of 21 NCAs. - Recommendation: reassess adequacy of risk resources, increase critical risk expertise (e.g., market risk expertise due to Brexit-related migrations), reassess MEL and inspection frequency, ensure dynamic SREP scoring for high-risk/high-priority LSIs. - SREP dynamics and digital platforms: - New information system (Artemis) and digital platforms allow updates when relevant information becomes available; recommendation to update SREP scores throughout the supervisory cycle in case of material changes. - Recommendation to coordinate BaFin and BBk use of digital platforms and review P2R add-on approach and precision (noting artificial precision of add-ons like 0.07 or 0.47 percent). - MEL, classification changes and implications: - ECB/SSM changed LSI classification effective 2022 to High-Impact (HI) and High-Risk (HR); HR dynamic (quarterly/ad hoc updates), HI annual with 2-year stability rule. - Once new classification effective January 2022, all HI and HR LSIs will be classified as MEL IV (potentially expanding MEL IV population and on-site inspection needs). - Focus Units coverage will in principle be classified as MEL IV, possibly increasing MEL IV count and inspection demand. ### Data collection, reporting granularity, and use of IPS information - Data collection status: - BBk collects quarterly financial data (nGAAP, mostly solo), supplemental information to the annual auditor’s report, reporting of large loans, ICAAP and ILAAP reporting, and data collection for Basel III projects. - All credit institutions must submit COREP and FINREP reporting to ECB/SSM. - Of 1,324 German LSIs: - approximately 79.5 per cent report FINREP data points only; - 0.8 per cent LSIs report oversimplified; - 19.2 per cent LSIs report simplified; - only 6 LSIs report full FINREP. - Analysis hampered by lack of granular data in certain risk areas (credit, market risk, related party transactions). - Project to improve collection of more granular real estate financing data to be implemented in 2023; BBk issued ordinance to collect semi-aggregate distributions regarding lending for acquisition of real estate (number and amount of loans granted; whether covered by debt insurance; loan to value ratios; debt servicing ratios; debt to income; some internal risk indicators). - Use of IPS insights: - IPSs provide cooperation agreements, cross-guarantee schemes, administer deposit insurance schemes and support centralized services (data centers, back-office, risk management). - Recommendation: contemplate utilizing IPS information (e.g., premium ratings) as IPSs often have greater direct contact with LSIs. - Recommendation: continue to progress collection of granular supervisory data and reassess scope and depth of data collected. ### Fintech, digitalization, and supervisory digital capabilities - Fintech landscape: - Germany is the leading country in continental Europe for fintech; hosts some of the largest neobanks and related service providers. - Germany licensed 3 crypto custodians and several others are in application to transition from registration to licensing. - Payment service providers regulated under ZAG had 48 applications for licensing or registration as of early 2022 (footnote context). - BBk’s 2020 survey indicated less than 7.5 percent of survey participants having traded at least once in crypto assets. - Business models often rely on outsourcing, third-party providers, and partnerships (distributed value chains). - Supervisory approach to innovation: - BaFin did not set up a sandbox; established an “innovation hub” in 2017 for market monitoring and internal coordination. - BaFin implementing structured in-depth workshops and an internal innovation radar. - Market participants perceive authorities as more reactive than proactive despite outreach efforts. - Digitalization of supervisory processes: - Joint digitalization agenda (7 workstreams) was put on hold early 2021 and is being restarted; focus on efficient exchange of data and shared use of tools rather than common data warehouses. - Recommendation: continue efforts to improve data exchange and shared tools; ensure supervisory assessment of credit institutions is based on one set of supervisory data. - Recommendation: develop structural fintech data collection, forward-looking dynamic market monitoring, and financial stability analysis. ### Key recommendations (selected, from Table 1 and text) - Institutional arrangements, coordination and cooperation 1) Streamline scope and frequency of BaFin’s microprudential reporting to MoF to ensure operational independence (¶13) - Priority: H (BaFin /MoF) - Timeframe: I 2) Complement BaFin reform agenda with a joint BaFin/BBk strategic agenda for banking supervision to avoid disjointed or duplicative supervisory approaches (¶21, ¶69) - Priority: H - Timeframe: I - Regulatory framework and supervisory guidance 3) Address legislative and guidance weaknesses in corporate governance framework to align with international best practices for dual board systems (¶29-30) - Priority: H - Timeframe: NT 4) Provide additional supervisory guidance to a) align MaRisk with EBA Guidelines on key banking risk issues (e.g., supervisory boards, credit risk, concentration, country risk, related party transactions (Appendix I, ¶53)); and b) clearly communicate use of intervention powers to the industry (¶52) - Priority: M - Timeframe: NT - Supervisory approach, tools and reporting 5) Improve reporting against supervisory priorities and workplans to ensure adequate mid-cycle adjustments (¶16) - Priority: H - Timeframe: I 6) Reassess adequacy of risk resources to ensure satisfactory coverage of on-site inspections and increase critical risk expertise (¶56, ¶68) - Priority: M - Timeframe: NT 7) Increase engagement with supervisory board members to ensure adequate oversight (¶55) - Priority: H - Timeframe: NT 8) Update SREP methodology to: a) better align MEL to high-risk/high-priority LSIs (¶40); b) incorporate other relevant factors (AML risk, IPS premium risk rating) (¶38, ¶57); and c) ensure dynamic SREP scoring for high-risk and high-priority LSIs (¶48) - Priority: M - Timeframe: NT 9) Ensure on-site inspection frequency is aligned with risk assessment score and ensure adequate coverage of larger LSIs (¶41, ¶47) - Priority: M - Timeframe: NT 10) Make earlier use of corrective and sanctioning powers to increase effectiveness dealing with lingering deficiencies and problem banks (¶52) - Priority: H - Timeframe: I 11) Reassess reliance on External Auditor work for MaRisk compliance to ensure supervisors can challenge EAs and undertake effective deep dive reviews (¶50, ¶51) - Priority: H - Timeframe: I 12) Reassess need for additional granular data to adequately assess risk areas (credit, market risk data, etc.) (¶60) - Priority: M - Timeframe: NT 13) Continue efforts to develop fintech data collection, forward-looking market monitoring and financial stability analysis (¶64) - Priority: M - Timeframe: NT ### Financial soundness indicators for banks, selected exact figures (2015–2020) - Capital adequacy — Regulatory capital to risk-weighted assets: - 2015: 18.3 - 2016: 18.8 - 2017: 19.4 - 2018: 18.9 - 2019: 18.6 - 2020: 19.2 - Regulatory Tier I capital to risk-weighted assets: - 2015: 15.7 - 2016: 16.3 - 2017: 16.9 - 2018: 16.6 - 2019: 16.5 - 2020: 17.2 - Sectoral distribution of loans to total loans — Loan to households: - 2015: 29.0 - 2016: 28.5 - 2017: 28.6 - 2018: 29.1 - 2019: 29.5 - 2020: 28.4 - Loans to non-financial corporations: - 2015: 15.2 - 2016: 14.9 - 2017: 15.1 - 2018: 15.7 - 2019: 16.1 - 2020: 15.4 - NPLs to gross loans: - 2015: 2.0 - 2016: 1.7 - 2017: 1.5 - 2018: 1.2 - 2019: 1.1 - 2020: 1.7 - NPLs net of provisions to capital: - 2015: 17.4 - 2016: 14.7 - 2017: 11.9 - 2018: 9.1 - 2019: 6.8 - 2020: 6.2 - Liquidity — Liquid assets to total short-term liabilities: - 2015: 146.5 - 2016: 146.6 - 2017: 151.3 - 2018: 151.7 - 2019: 161.2 - 2020: 169.6 - Sensitivity to market risk — Net open positions in FX to capital: - 2015: 4.6 - 2016: 4.0 - 2017: 3.7 - 2018: 3.2 - 2019: 3.7 - 2020: 3.4 *International Monetary Fund — Executive Summary and chapter extracts from content unit 1deuea2022007* ### EXECUTIVE SUMMARY __________________________________________________________________________ 5 ### EXECUTIVE SUMMARY ### Context and Scope - The Financial Sector Assessment Program (FSAP) conducted a focused review that primarily assessed banking regulation and supervision of Germany’s less significant institutions (LSIs). - Germany accounts for 1,324 of about 2,400 total LSIs in the Euro Area (representing 40 percent of Germany’s banking sector assets and approximately 55 per cent of total Euro Area LSI assets). - As Germany is part of the Euro Area, the regulation and supervision of banks takes place within the European Central Bank’s (ECB) Single Supervisory Mechanism (SSM). The Federal Financial Supervisory Authority (BaFin) and the Deutsche Bundesbank (BBk) are responsible, under the oversight of the ECB, for the supervision of LSIs. - The review reflects the regulatory and supervisory frameworks as per October 19, 2021. ### Progress since 2016 BCP assessment and Wirecard response - Authorities made good progress on implementing recommendations of the 2016 Basel Core Principles (BCP) assessment: - Roll-out of the ECB/SSM approach to the Supervisory Review and Evaluation Program (SREP) to all LSIs. - Enhancements to liquidity risk (roll-out of LCR and related reporting). - Enhancements to operational risk (including on cyber risk). - Expansion of financial accounting oversight powers for BaFin. - In response to the Wirecard fraud: - The Federal Ministry of Finance (MoF) initiated a reorganization program including legal and structural reforms impacting BaFin to strengthen forensic audit, enforcement of financial reporting quality by external auditors, whistleblower information use, consumer protection powers and capacity, and creation of a center for digital data excellence for supervisory digital analysis. - The (internal) powers of the President of BaFin were strengthened to set strategic direction, budget proposal, organization structure and the ability to give directions to BaFin’s Executive Directors. - These reforms aim to enable earlier use of corrective and sanctioning powers to increase effectiveness in dealing with lingering deficiencies of problem banks. - The joint modernization project was concluded December 17, 2021. - Wirecard Bank (the unit supervised by BaFin’s banking supervision) did not run into insolvency and is currently conducting a voluntary wind down. ### Institutional arrangements and operational independence - The MoF is now expected to step back from the reorganization program as well as streamline current reporting to a more systematic approach to ensure BaFin’s operational independence. - It is imperative that BaFin maintain operational independence while ensuring sufficient information flow from BaFin to the MoF. - A joint BaFin and BBk strategic agenda is critical to avoid duplicative or disjointed efforts and is necessary to ensure an effective banking supervision program. - The joint strategic agenda should recognize the need for joint projects (e.g., joint digitalization agenda). - Strengthening mid-cycle reporting against supervisory priorities between BaFin and BBk will help ensure agility in responding to crises, emerging risks and adjusting supervisory resources. ### Corporate governance, external auditors, and supervisory capacity - Further enhancements are needed to align the corporate governance framework with international best practices: - For dual board systems, the role of the supervisory board needs to be further strengthened in oversight of key control functions (direct reporting lines of internal audit, compliance and risk management). - Current construct leaves room for management boards to dominate essential control functions. - Stricter requirements for independence of board members and heading up key committees, and increased supervisory engagement, are recommended. - Reassess reliance on external auditors (EAs): - German authorities place great reliance on the role of the external auditor, particularly with respect to compliance with the minimum risk management requirements (MaRisk). - Supervisors must be able to challenge EAs’ work and perform deep dives on risk areas when needed (e.g., deep dives on credit file reviews to assess connected and related party transactions). - Ensuring supervisors have adequate access to granular data will strengthen assessment of institutions’ risk areas. - Supervisors, EAs and industry would benefit from further guidance to complement principle-based MaRisk to clearly communicate supervisory expectations for banks. MaRisk’s principle-based nature does not necessarily clearly outline supervisory expectations specific for banks in all areas (Circulars cover certain aspects but not all). ### Supervisory framework, SREP, on-site inspections and resources - Germany finalized the roll-out of the ECB/SSM LSI SREP methodology to all LSIs in 2020. - The German SREP methodology, developed along EBA SREP Guideline and ECB’s SSM LSI methodology, determines a SREP score for each LSI annually. - Based on SREP score, authorities determine both the minimum level of engagement (MEL) and the minimum frequency for on-site inspections of LSIs. - Areas needing strengthening: - The MEL currently does not include engagement of management function or risk control functions even for the lowest risk assessment score (SREP 4). - Frequency of on-site inspections should be reassessed to ensure adequate coverage of riskiest LSIs (current minimum frequency of up to a 4-year on-site inspection cycle) and highest impact LSIs (greater than EUR15Bn total assets – currently up to 10-year cycle). - BaFin/BBk need to reassess adequacy of risk resources to ensure satisfactory coverage of on-site inspections, deep dive reviews and critical risk expertise (e.g., market risk expertise for institutions shifting activities to Germany post-Brexit). - Need for earlier use of corrective and sanctioning powers to deal with lingering deficiencies and problem banks. ### Fintech, digitalization, and data collection - Germany is the leading country in continental Europe for fintech, hosting some of the largest neobanks and related service providers. - BBk’s Statistics Directorate ran a pilot project to collect data on fintech; initial results indicate fintech size across financial sectors is still relatively small. - Given rapid growth, a more structural approach to fintech data collection, forward looking dynamic market monitoring and financial stability analysis is important going forward. - BaFin reforms include creation of a center for digital data excellence to provide and continuously develop competencies and tools for digital analysis of data and information in supervisory activities. ### Key Recommendations on Regulation and Supervision of LSIs (as presented in Table 1) - Institutional arrangements, and coordination and cooperation 1) Streamline the scope and frequency of BaFin’s microprudential reporting to the MoF to ensure operational independence (¶13) - Priority: H (BaFin /MoF) - Timeframe: I 2) Complement the BaFin reform agenda with a joint BaFin/BBk strategic agenda for banking supervision to avoid disjointed or duplicative supervisory approaches (¶21, ¶69) - Priority: H - Timeframe: I - Regulatory framework and supervisory guidance 3) Address legislative and guidance weaknesses with the corporate governance framework to align it with international best practices for dual board systems (¶29-30) - Priority: H - Timeframe: NT 4) Provide additional supervisory guidance to a) align MaRisk with EBA Guidelines on key banking risk issues (e.g., supervisory boards, credit risk, concentration, country risk, related party transactions (Appendix I, ¶53)); and b) clearly communicate use of intervention powers to the industry (¶52) - Priority: M - Timeframe: NT - Supervisory approach, tools and reporting 5) Improve reporting against supervisory priorities and workplans to ensure adequate adjustments are made mid-cycle (¶16) - Priority: H - Timeframe: I 6) Reassess adequacy of risk resources to ensure satisfactory coverage of on-site inspections and increase critical risk expertise (¶56, ¶68) - Priority: M - Timeframe: NT 7) Increase engagement with supervisory board members to ensure an adequate oversight function is in place and working effectively (¶55) - Priority: H - Timeframe: NT 8) Update SREP methodology to: a) better align the minimum engagement level to the high-risk/high priority LSIs (¶40); b) incorporate other relevant factors (AML risk, IPS premium risk rating) (¶38, ¶57); and c) ensure dynamic SREP scoring for high-risk and high-priority LSIs (¶48) - Priority: M - Timeframe: NT 9) Ensure on-site inspection frequency is adequately aligned with the risk assessment score and ensure adequate coverage of larger LSIs (¶41,¶47) - Priority: M - Timeframe: NT 10) Make earlier use of corrective and sanctioning powers to increase effectiveness of dealing with lingering deficiencies and problem banks (¶52) - Priority: H - Timeframe: I 11) Reassess the extent of the reliance on the work of the External Auditor (EA) for compliance with MaRisk to ensure the ongoing ability of supervisors to challenge EAs on LSI’s strength of risk management practices, including the ability to undertake effective deep dive reviews of credit files (¶50, ¶51) - Priority: H - Timeframe: I 12) Reassess the need for additional granular data to adequately assess risk areas of institutions (certain aspects of credit, market risk data, etc.) (¶60) - Priority: M - Timeframe: NT 13) Continue efforts to develop fintech data collection, forward looking dynamic market monitoring and financial stability analysis (¶64) - Priority: M - Timeframe: NT *International Monetary Fund — Executive Summary (Technical Note on LSI regulation and supervision in Germany)* ### 7. Germany’s bank-centric financial sector is large and well-developed. Credit institutions, ### 1deuea2022007 - 7. Germany’s bank-centric financial sector is large and well-developed. Credit institutions, ### Structure and size of the financial and banking sector - Credit institutions have assets equivalent to 270 percent of GDP and account for about 60 percent of the financial sector assets. - Banking sector three-pillar structure: commercial banks, public savings banks and cooperatives. - Number of institutions and market shares: - 21 large banks and banking groups (SIs) and 1,324 LSIs as defined in the context of the ECB Single Supervisory Mechanism (SSM). - At the Euro Area level, Germany accounts for 25 percent of total Euro Area bank assets and about 55 percent of total Euro Area LSI assets. - German share of SSM institutions: 21 of 114 SIs and 1,324 of about 2,400 LSIs are German. - 25 third country bank branches (not in scope of the SSM; responsibility of National Competent Authorities). - 41 other credit institutions (including 15 development banks). - 38 securities trading banks. - 427 leasing and factoring institutions. - 47 housing enterprises with saving schemes (licensed in a different category than credit institutions). - Definitions: - A credit institution is defined per section 1 (1) of the Banking Act (KWG). - A CRR credit institution meets the definition in Article 4 (1) no. 1 of the EU Capital Requirements Regulation (CRR) and is supervised in the context of the SSM either directly by the ECB as SIs or by BaFin together with BBk as LSIs. - Securities trading banks and other credit institutions are not CRR credit institutions but fall within the German KWG definition and are supervised by BaFin in cooperation with BBk. - Note on data sources: Numbers based on BaFin’s Annual Report 2020, ECB/SSM published list of SIs and ECB’s Risk Report on LSIs (2020). ### Institutional protection schemes and operational cooperation - Public savings banks and cooperatives participate in Institutional Protection Schemes (IPSs) that: - Provide cooperation agreements and cross-guarantee schemes for subsectors. - Administer the subsectors’ deposit insurance schemes. - Support centralized services (e.g., data centers, back-office and risk management functions) to realize economies of scale. - Private commercial banks maintain their own deposit insurance scheme and voluntary top-up scheme. - IPS definition: A contractual or statutory liability arrangement which protects its member institutions and ensures liquidity and solvency needed to avoid bankruptcy where necessary. ### Recent trends and sector performance - Bank numbers and consolidation: - Total assets of the banking sector increased over the past five years, while the number of banks decreased. - Number of LSIs decreased from 1,562 in 2016 to 1,324 in 2020, mainly due to mergers and amalgamations. - Brexit contributed to an increase in license applications for CRR-institutions, bank branches, securities banks, and securities trading firms in Germany. - Profitability and key indicators: - German banks’ low profitability was exacerbated during the COVID-19 pandemic, though key banking sector indicators remain sound. - Interest margins to gross income declined from 71.2 percent (2016) to 69.5 percent (2019). - COVID-19 effects: necessity to book additional loan loss provisions and return on assets (0.16 percent) and equity (2.71 percent) as of September 2021. - Capital adequacy, non-performing loan and liquidity ratios are described as healthy. - The sector is characterized by a relatively high cost-to-income ratio. - Profitability is highly dependent on interest income; gross income increased slightly during 2016–2019 while operating costs decreased. ### Institutional setting: roles, responsibilities, and resourcing - Federal Ministry of Finance (MoF): - Responsible for financial market legislation and legal (Rechtsaufsicht) and technical (Fachaufsicht) supervision of BaFin (section 2 FinDAG). - Bears political responsibility for BaFin’s activities; legal and technical supervision covers legality and fitness for purpose of BaFin’s administrative actions. - BaFin: - Federal agency under the MoF; integrated financial sector supervisory authority responsible for prudential supervision of credit institutions, insurers and pension funds, capital markets intermediaries, market conduct and consumer protection. - National resolution authority (NRA) for LSIs without cross-border operations. - Budget needs annual approval by its Administrative Council and is funded through levies from supervised institutions. - Staff and directorates: - Total about 2,720 staff, of which about 550 work in the Banking Supervision Directorate (BSD). - BSD covers supervision of LSIs, other credit institutions, third country bank branches, leasing and factoring institutions, payment and e-money institutions, and housing enterprises with saving schemes (in total over 1,900 institutions). - Securities trading banks supervised by BaFin’s Securities and Asset Management Supervision Directorate. - Cooperates with BBk for day-to-day supervision of credit institutions (require close alignment of supervisory processes). - Deutsche Bundesbank (BBk): - Key role in day-to-day (off- and on-site) supervision of credit institutions; responsibilities include monetary policy and financial stability. - Funding model: offsite supervision funded through BBk’s budget; onsite inspections are paid for by inspected institutions. - Staff: about 1,550 staff directly involved in supervision of credit institutions (deployed approx. 33 percent SIs / 67 percent non-SI credit institutions). - BBk submits day-to-day supervision results with recommendations to BaFin; BaFin makes final assessments and decisions. - Single Supervisory Mechanism (SSM) / ECB: - SSM composed of ECB and NCAs grants ECB leading supervisory role over banks in the EU. - ECB directly supervises SIs and oversees LSI supervision by NCAs. - BBk and BaFin (German NCA) participate in ECB joint supervisory teams (JSTs). - Operational division of responsibilities set out in the SSM Framework and national “Supervision Guideline”. - ECB has oversight role for LSI supervision and direct responsibility for licensing, withdrawal of licenses, and qualifying holdings in LSIs (proposals for approval drafted by the NCA). Authorization of third-country bank branches is the responsibility of NCAs. - European Banking Authority (EBA): - Independent EU authority to ensure effective and consistent prudential regulation and supervision across the European banking sector and to contribute to the European Single Rulebook. ### Governance, reporting, independence concerns, and recommended improvements - BaFin reporting to the MoF: - BaFin is subject to broad reporting requirements to the MoF in the context of legal and technical oversight. - Reporting covers issues beyond financial stability, including microprudential developments of “material importance”, changes to regulations and guidance, and internal decisions regarding fundamental changes to BaFin’s organization and personnel. - The MoF “may at any time require BaFin to report on the knowledge available to it or its actions and ask to submit documents.” - Reporting practices include division-level (“DIS”) reporting submitted by the office/secretariat of the Executive Director of each Directorate to the MoF. - The detail and frequency of communication between BaFin and the MoF appear to go beyond necessary oversight and raise questions about BaFin’s operational independence. - Recommendation: streamline and systematize BaFin’s reporting to the MoF - BaFin and the MoF should adopt a more systematic and streamlined approach to provide assurance on BaFin’s operational independence. - Discussions between BaFin and the MoF on reporting and timing for the MoF to step back from its role in the reorganization program have begun. - Reporting should be oriented towards the newly established reporting processes for supervision of innovative/particularly risky and/or struggling business models (“KFT-reporting”). - For ongoing supervision, reporting should occur regularly ex-post, at a predetermined frequency, and at an aggregate sectoral and cross-sectoral level. - Individual file information should be included only as necessary for the MoF to fulfill legal and technical oversight obligations. - For financial stability issues, consider alternative mechanisms for MoF information (e.g., via the G-FSC). - Elevate responsibility for reporting to the office/secretariat of BaFin’s President. - Reflect a newly agreed reporting framework in the document describing principles for MoF technical and legal oversight of BaFin. ### Cooperation, information exchange, and management reporting - Existing cooperation mechanisms: - German Financial Stability Committee (G-FSC): central committee for macroprudential surveillance; MoF, BBk, and BaFin each have three voting representatives; BaFin has one non-voting advisory representative for resolution mandate. - Committee on Ongoing Supervision (GIA): BaFin and BBk monitor overall risk situation and specific risks; discussions can lead to supervisory measures; usually meets quarterly. - Committee for Risk Oriented Analysis (AGRA): discusses policies, regulations, guidelines, supervisory practices, tools and operational cooperation issues between BaFin and BBk. - Regular reporting to the ECB: BaFin/BBk provide COREP and FINREP reporting, annual benchmarking data, funding plans for LSIs where applicable, supervisory priorities for LSI supervision, SREP-score and subcomponents for all LSIs, supervisory planning for HP-LSIs, and annual report on LSI supervision. Complemented by ad-hoc notifications per SSM Framework and Guidance for NCAs. - Informal day-to-day communication between BaFin and BBk, and regular communication with ECB/SSM Germany Desk (several times per week). - ECB updates and LSI notification expectations: - ECB updating guidance for NCAs on notification expectations for LSIs to clarify earlier ex-ante notifications of potential significant impact events and criteria for materiality of draft decisions. - ECB adjusted classification of LSIs to capture large and high-risk LSIs, replacing High-Priority classification with High-Impact and High-Risk criteria to better identify LSIs that might become problematic. - Management reporting and performance tracking improvements needed: - BaFin/BBk should establish a system to allow management to track progress on supervisory priorities, execution of the agreed work program, impact of ad-hoc work, and key performance indicators. - Observations: information exists across committees and tools, but a clear set of performance indicators is not defined and information is not combined into a succinct comprehensive management report. - BaFin/BBk are in early stages of developing a dashboard to support management evaluation of resource use and progress tracking against the work program; dashboard expected to inform a comprehensive management report and facilitate equal line of sight by both BaFin/BBk mid-cycle. *Source: 1deuea2022007 - 7. Germany’s bank-centric financial sector is large and well-developed. Credit institutions* ### 17. Building on the key lessons from the Wirecard fraud, the MoF announced a BaFin ### 17. Building on the key lessons from the Wirecard fraud, the MoF announced a BaFin reorganization program, which is currently ongoing, including several legal reforms. ### Reorganization program — scope and workstreams - The reform program consists of the following workstreams: - 1) creation of Focus Units dedicated to the supervision of complex institutions; - 2) creation of a forensically trained Task Force to undertake special audits; - 3) reform of the financial reporting enforcement system (see also para 25); - 4) closer engagement with market participants and follow up on whistleblower reports; - 5) strengthening of consumer protection powers and capacity; - 6) strengthening of the position of BaFin’s President; - 7) creation of a central digital data unit (see section on digitization); - 8) cultural change. - Initiated in response to the Wirecard failure, the reforms are also relevant in the context of the failure of Greensill Bank. - The rollout described below focuses on implications for banking supervision. ### Powers of BaFin’s President and governance changes - In July 2021 amendments were made to provide BaFin’s President more powers, which the FSAP supports. - The President received stronger internal powers vis-à-vis BaFin’s strategic direction, budget proposal, organizational structure, ability to give directions to Executive Directors (make final overriding decisions) and has been given direct responsibility for the Task Force and Focus Units. - These changes provide the President with the ability to take direct responsibility for dealing with “watch list” and problematic institutions, in particular in cases with a cross-sectoral dimension. - Organizational changes and the budget still need the approval of respectively the MoF and BaFin’s Administrative Council. ### Focus Units, Task Force, and operational rollout - BaFin has set up dedicated units to monitor watch-list and complex institutions more closely and have the ability to respond quickly to emerging risks. - The reorganization aims to: - free up capacity for the supervision of LSIs and other institutions to address more complex structures and business models (Focus Units); - create in-house on-site investigative capacity to respond to risks or suspicions that warrant immediate attention (Task Force), reducing dependence on external capacity. - Project timeline and coordination: - Pilot phase for banks since May 2021; - Go-Live in August 2021 within the entire BaFin. - The initiative already builds on a cooperative approach with BBk, but still needs fuller integration into the overall banking supervision framework. ### From “ability to act” to “willingness to act” — culture and supervisory consistency - While the legal framework provides BaFin broadly with sufficient tools (“ability to act”), the program aims to create a more proactive supervisory culture (“willingness to act”). - A change of culture will be challenging and take time (is in its initial stages) but is important to establish a more proactive culture that addresses issues more decisively (see paragraph 52). - Recommendation: BaFin should consider establishing a more consistent culture and, to the extent practical, supervisory approaches across all sectors of the organization. - For banking supervision, explicit consideration will be needed of the culture across BaFin and BBk staff. ### BaFin/BBk cooperation and MoF role - The buy-in of BBk for these reforms and development of a complementing joint BaFin/BBk strategy will be critical for effective banking supervision going forward. - Previously existing joint BaFin/BBk projects appear to have been put on hold (e.g., joint digitalization agenda) with the start of the reorganization program, risking a disjointed supervisory approach. - Risks include inefficiency (duplication of systems development) and reduced effectiveness (incomplete view of relevant information and risk perspectives across the two organizations). - The ability to fully cooperate appears to have been hampered by MoF oversight of the reform program and perceived potential implications for BBk’s independence. - The authorities indicated that the MoF will step back from its direct involvement in the reorganization program by end 2021; recommendation: the existing reorganization program should be complemented with a joint BaFin/BBk strategy and direct MoF interventions in BaFin’s reorganization initiatives should be minimized or eliminated. ### Corporate governance modernization — gaps and recommendations - The reform agenda should be expanded to include modernization of the corporate governance framework to align with international best practices. - Current observations: - The reform agenda covers only to a limited extent lessons learned from corporate governance failures at Wirecard and Greensill. - The recently issued Act to Strengthen Financial Market Integrity (FISG, effective January 2022) contains some provisions to strengthen internal controls and obligations and liabilities of supervisory Board members (see paragraph 25). - There is no clear agenda to realize a more fundamental modernization of the corporate governance framework (see paragraph 30 and Appendix II) and supervisory approach to review and require a better functioning of supervisory boards (see paragraph 54 and 55). - Rationale: Modernization of the corporate governance framework, requiring material changes to the existing legal framework, is key to ensuring critical checks and balances for supervisory boards to effectively oversee executive management activities. ### Legal and regulatory framework — implementation of Basel III-related standards - Since the 2016 assessment the European authorities made further progress with the implementation of Basel III and other relevant Basel standards. - Key legislative and regulatory milestones: - The Capital Requirements Directive (CRD) IV and Capital Requirements Regulations (applicable per 1 January 2014) implemented the June 2011 revised version of the Basel III framework, as well as the liquidity coverage ratio. - The CRR II (effective June 28, 2021) complements the framework with: - implementation of the Net Stable Funding Ratio (with a proportionate approach for small and non-complex institutions), - leverage ratio (for SIs as well as LSIs), - standardized approach for counterparty credit risk (with a proportionate approach for LSIs), - some Pillar 3 changes. - CRR II completed the implementation of the 2014 Basel Supervisory framework for measuring and controlling large exposures. - Pending transposition: - The “Basel III: post crisis reforms (December 2017)” and the minimum requirements for market risk (revised by the BCBS in January 2019) have not yet been transposed into European regulations. - The European Union announced in October 2021 that it plans to delay the foreseen implementation per January 2023 to January 2025 (with a 5-year transition period, i.e., full implementation by January 2030). ### Domestic transposition and recent German legislation - December 2020 transpositions: - The CRD V and Bank Recovery and Resolution Directive (BRRD) II were transposed into German law via the Act on Risk Reduction and Proportionality Act for the Banking Sector (RiG), December 2020. - RiG changes include (inter alia): - introduction of an approval and consolidated reporting requirement for (mixed) (EU) parent financial holding companies (section 2f KWG); - broadening the definition of related party transactions (section 15 KWG); - requiring management and supervisory board members to refrain from participating in decisions in cases of conflict of interest (section 15 KWG); - collective suitability requirements for the management board (section 25c (1a) KWG); - an explicit legal basis to reprimand members of the management board (section 36(2) KWG). - RiG introduced administrative reliefs for small and non-complex institutions (SNCI) as part of a proportionality approach. - 2021 reforms on auditor oversight and service provider powers: - The Act to Strengthen Financial Market Integrity (FISG), effective January 2022, strengthens financial accounting oversight of listed companies. - Key FISG changes: - Two-stage financial reporting enforcement procedures fundamentally revised. - Authority to conduct forensic audits assigned exclusively to BaFin (resulting from a BaFin reorganization workstream). - This allows BaFin to order its own (forensic) examination in case of concerns regarding violation of accounting rules. - To fulfill this responsibility, BaFin will receive an increase in resources. - Provisions increase liability of supervisory board members, require setup of an audit committee, and give the Chair of the supervisory board certain information rights. - BaFin granted extended powers and intervention rights regarding certain outsourcing providers. - Comprehensive amendments and stricter regulations to combat accounting fraud. - Provisions to improve communication between BaFin, stock exchange supervisory authorities and the Audit Oversight Body (APAS). - These amendments form part of the new enforcement regime for issuers of securities admitted to official listing. ### Regulations and guidance — MaRisk and EBA Guidelines - MaRisk: - Minimum requirements for risk management (MaRisk) provide high-level principles and concepts for the risk management of banks. - MaRisk was most recently updated in August 2021. - To understand supervisory expectations of MaRisk, it must be read with EBA, BaFin and other relevant guidelines that provide more detailed requirements and expectations regarding governance, risk management and internal controls. - EBA Guidelines and BaFin declarations: - BaFin declared compliance with most of the EBA Guidelines and where needed adopted these in domestic regulations and guidance. - Unless the German authorities explicitly declare non-compliance, EBA Guidelines are considered binding administrative provisions. - BaFin has declared (partial) non-compliance with 8 (out of slightly more than 100) EBA Guidelines and Recommendations, mostly for reasons of proportionality and applicability within the German legal framework. - For guidelines with declared (partial) non-compliance, domestic guidelines are usually issued implementing the EBA Guideline to the extent relevant to German circumstances. ### Progress since 2016 and remaining gaps - Progress: - Updated MaRisk to include key concepts from EBA Guidelines. - Issued guidelines addressing several 2016 recommendations. - Sixth version of MaRisk issued in August 2021 implementing key (high-level) concepts of EBA Guidelines on non-performing loans, outsourcing and the EBA Guidelines on ICT and security risk. - Improvements to BaFin guidance notices on fit and proper requirements for management and supervisory board members. - Ex-ante management reporting requirement introduced in case of replacement of the head of internal audit or compliance. - Remaining gaps (examples): - 2016 recommendations relating to corporate governance, significant investments and related party transactions still need addressing. - No requirements that provide heads of internal control functions (internal audit, compliance and risk) direct and independent access to the supervisory board; KWG requires that management board be informed of such requests. - Supervisory board responsibilities remain limited (no decision making responsibilities regarding strategic direction, risk appetite, strategy and related policies). - No requirements for ex-ante review of significant investments in financial institutions outside the Euro Area. - Broadened definition of related party transaction in KWG but limited framework requiring financial institutions to establish appropriate procedures to manage and monitor related party transactions; no specific requirements to set internal limits, aggregate and regularly report exposures to the supervisory board or for regulatory reporting of these exposures. - Corporate governance independence: - The German corporate governance framework does not contain requirements for “independent” supervisory board members nor requirements for independence of the chair or inclusion of independent members in supervisory board committees. - Absence of independent members impairs the supervisory board’s ability to effectively challenge management and limits assurance that management decisions are taken in the bank’s best interest. - Some progress since 2016 (e.g., adding “independence of mind” requirements) but current situation still allows management boards to dominate essential control functions. ### Supervisory approach, tools and reporting — assessment and recommendations - Overall: - Supervisory approach, tools and reporting are largely comprehensive, but certain aspects need further enhancement. - BaFin/BBk completed, in a coordinated manner, the implementation of their own SREP process for LSIs leveraging off of the SSM LSI framework. - Identified needs: - For higher risk/higher impact or large LSIs, strengthen the minimum level of engagement and the frequency of on-site inspections. - Given reliance on external auditors (EA) regarding compliance with MaRisk, German authorities need to strengthen ability to challenge work of the EA when necessary (e.g., undertake in-depth credit review or assess adequacy of an LSI’s risk management control framework). - Issue additional guidance to clarify expectations for industry and internal use by supervisory staff. - BaFin should make earlier use of its available corrective and sanctioning powers to ensure more proactive and effective supervisory actions occur timely. - Address overall implications on adequacy of supervisory resources (both risk expertise and capacity). - Supervisory flexibility: - NCAs have considerable freedom to develop their own supervisory approach on the basis of the SSM LSI oversight framework, within ECB overarching boundaries (e.g., supervisory priorities, SREP methodology, joint supervisory standards, supervisory cycle and allowance for a proportionate approach). *Source: IMF staff report chapter text provided in content unit 1deuea2022007* ### 33. The German supervisory approach is governed by the principles of proportionality. ### 1deuea2022007 - 33. The German supervisory approach is governed by the principles of proportionality. ### Proportionality and oversight architecture - BaFin/BBk explicitly take into account the nature, scale and complexity of the LSI’s activities. - Two new BaFin Focus Units and a Task Force will expand BaFin’s ability to devote more time to complex structures, business models and issues requiring more or immediate attention. - The ECB/SSM’s oversight function impacts the supervisory strategy of all 21 participating in the SSM. - The ECB works closely with national supervisors to foster a common application of rules and the consistent application of “joint supervisory standards” across the Euro system for LSIs. - For German authorities, consideration of the ECB/SSM’s supervisory priorities for German LSIs is required annually (example: ECB/SSM focus for LSIs for 2021/22 includes credit risk, unique business model, operational and cyber risk). - ECB/SSM is undertaking a thematic review of corporate governance frameworks and supervisory assessment practices across all NCAs; BaFin/BBk are expected to adopt some or all of these themes in their supervisory strategy for LSIs. ### SREP methodology, scoring, and recent roll-outs - Germany completed the roll-out of the EU harmonized LSI SREP methodology in 2020. - The LSI SREP harmonized methodology was developed along the lines of the EBA Guideline on SREP and the ECB’s SSM LSI SREP methodology (February 2020). - SREP score is a key driver for frequency and intensity of supervisory activities (including both the minimum engagement level (MEL) and the supervisory examination program (SEP)). - General phases of SREP assessment include: i) classification/categorization of the LSI; ii) monitoring of key financial indicators; and iii) assessment of business model analysis, strength of internal governance, and overall assessment of the impact of all risks to the LSI’s capital and liquidity. - German proportionality approach distinguishes between: - full SREP (including an assessment of the Pillar 2 capital add-on (P2R)); and - summary SREP (updating the risk score, but no reassessment of the P2R). - Pillar 2 Guidance (P2G) is an additional buffer determined based on stress-testing results; assessment/review of the P2G is usually conducted every 2 years. - BaFin/BBk update the SREP score of all LSIs at least annually. - A full SREP, including the P2R, is undertaken on a 1–3 -year cycle depending on the SREP score and additional criteria. - Since 2018 supervisors are expected to incorporate findings of AML-deficiencies in the SREP score; Germany plans to link (rollout in 2022) the component of LSI’s compliance with AML/CFT requirements to the overall SREP score. - Identified disconnects: AML/CFT supervisory information was not necessarily available to the BBk for ongoing supervision; current framework did not provide sufficient assurance on incorporation of relevant AML/CFT observations into the SREP score. - Two main dimensions used to classify LSIs in the methodology: risk/quality (reflected in a risk assessment score) and impact (reflected in an impact rating). ### Aggregate and distributional SREP/impact findings (supervisory cycle ending 2020) - Majority of LSIs are rated medium-low or low impact rating: 81.4 percent (approximately 1,078 LSIs). - Fairly high-quality SREP score of 2 for approximately 67.5 percent of LSIs for the supervisory cycle ending 2020. ### MEL framework, engagement, and control functions - MEL categories: I-IV define offsite work and periodic meetings with the institution and its key bodies and control functions. - Current MEL categories in Germany do not include an expectation/requirement to engage with key control functions for all categories; this is particularly problematic for high-risk and high-impact LSIs. - In practice, engagement levels for high-risk LSIs go beyond the minimum MEL in Germany (e.g., 2021 cycle included a full SREP assessment and a discussion with the management board for high risk/high impact LSIs). - Recommendation: structural increase in the level of engagement for high risk/high impact LSIs would be appropriate because the current minimum is not informative from a management perspective. - Institutions covered by BaFin Focus Units will in principle be classified as MEL IV (which may expand the number of institutions classified as MEL IV). ### On-site inspection frequency and resourcing - Current frequency of on-site inspections: 4- 12 years (not directly linked to MEL but to the MEL underlying SREP risk/impact matrix). - The German SREP methodology calls for up to a 4-year on-site inspection frequency for an LSI (MEL IV) with both a high-impact and high-risk (i.e., SREP 4 score). - Observed practice: it is not possible for BaFin/BBk to field onsite inspections to all institutions at e.g., a 1 – 4 years frequency given available resources; focus should be on high-risk and high-impact LSIs (including large LSIs). - Recommendation: reassess frequency of on-site inspections for high risk/high impact LSIs (including large LSIs) and link it to the MEL framework to ensure adequate supervisory coverage. - Suggested supervisory approach: risk-based, forward looking, leveraging assurance from institutions’ corporate governance and internal controls and third parties (e.g., external auditors and audits by IPSs and deposit insurance schemes). - Inspectors’ capacity constraint: ensuring adequate coverage may require expanding capacity (e.g., increase in FTEs). - Large-LSI inspection cycles: LSIs with greater than EUR 25 billion in total assets currently have at least an inspection cycle of up to 10 years; for lower impact institutions the inspection cycle can go up to 12 years — prudence suggests shorter comprehensive inspection cycles for larger LSIs. ### Pandemic impact and inspection statistics - During the pandemic, on-site inspections were approximately half in number from the previous year. - Inspections in 2020 represented about 6 percent of LSIs (and around 12 percent under normal conditions). - On-site inspections in 2020 mostly focused on compliance with MaRisk and special topics such as internal models. - Authorities are in the process of returning to more normal pre-pandemic levels of on-site inspections. ### ECB/SSM classification changes and implications - Effective 2022, ECB/SSM will change LSI classification from high priority (HP) and non-HP to: - High-Impact (HI) (e.g., size of total assets >€15Bn, cross border activities, potential SI status, importance to the market infrastructure, etc.); and - High-Risk (HR) (breach or deterioration of quantitative indicators, SREP score of 4 or SREP-Score of 3 and 4 for any of the SREP risk categories, and additional riskiness indicators such as removal of a board member). - HR category will be a dynamic classification expected to be updated every quarter or on an ad hoc basis. - The HI rating will be updated on an annual basis with a stability rule of two years (e.g., a bank will remain high-impact for at least two years). - A credit institution with an overall SREP score 4 that is a member of an IPS (or overall SREP 3 score with a score of 4 in any of the key risk categories) that is a member of an IPS or is a SNCI will not be classified as a HR LSI for reporting purposes to the ECB/SSM. - Once the new classification methodology is effective in January 2022, all the HI and HR LSIs will be classified as MEL IV (potentially expanding the number of MEL IV institutions and impacting the need for additional on-site inspections). ### Group risks, recent failures, and Focus Units - The Greensill and Wirecard failures highlighted the need to include risks from the wider group and intra-group dependencies in LSI assessments. - These failures increased attention at SSM level to identification (licensing and designation) of Financial Holding Companies (FHC) and to explicitly account for group structures when assessing business models as part of the SREP. - BaFin established two Focus Units (August 2021) to deepen supervisory assessment of institutions with complex structures or innovative business models. - Institutions covered by the Focus Units would not necessarily overlap with high-risk LSIs identified in the new ECB/SSM reporting framework; complexity does not always correlate with SREP 4 scores. - Coverage implications: institutions covered by Focus Units will in principle be classified as MEL IV, which may increase MEL IV numbers and potentially necessitate additional on-site inspections. ### Supervisory tools, planning, and coordination - BaFin has ultimate responsibility to approve supervisory plans and supervisory tools for all LSIs each year. - BaFin and BBk perform supervisory planning (mid-October) and agree/approve (by mid-December): - the SREP score (including the ICAAP assessment and P2R/P2G if applicable); - adjustments to planned on-site inspections to account for other BaFin work (e.g., AML); and - utilization of an External Auditor (EA) to carry out required special audits beyond planned BBk on-site inspections. - Example: for impairment and valuation related special audits, BaFin usually hires EAs while BBk tends to cover other planned onsite inspections. - BBk collects prudential returns, receives LSIs’ audited reports prepared by EAs, completes an annual risk assessment (“risk analysis”), and undertakes on-site inspections for a relatively small portion of LSIs during the supervisory cycle. - Recent operational enhancement: BaFin and BBk adopted a new system (Artemis) that can capture relevant information from day-to-day supervision and resulting changes to the SREP score (see paragraph 48 for discussion on maintaining a dynamic SREP score). *Source: 1deuea2022007 - 33. The German supervisory approach is governed by the principles of proportionality.* ### 48. In the past SREP scores were not often changed throughout the year, however with ### 1deuea2022007 - 48. In the past SREP scores were not often changed throughout the year, however with ### SREP framework, dynamics, and immediate recommendations - Findings: - With the introduction of a new digital platform, more up-to-date information is available to supervisors throughout the year. - Historically, SREP scores were not often changed throughout the year. - BaFin has recently launched a new information system that allows for updates when relevant information becomes available. - A dynamic SREP score is key to ensuring the German authorities know when an LSI’s risk profile is deteriorating (e.g., from a 2 to a 3 or from a 3 to a 4 SREP score). - Recommendations: - Update SREP scores throughout the supervisory cycle, when necessary (e.g., when excessive growth rates are noted, relevant other public information becomes available, after an on-site inspection or special audit is completed, etc.), in case of material changes. - BaFin should coordinate with BBk to ensure SREP scores are driven by the same analytical risk data and that both organizations coordinate the new digital platforms (see paragraphs 21 and 69). - Review the approach to P2R add-ons now that SREP has been fully rolled out and first experiences with P2R add-ons have been gained. ### P2R add-ons, benchmarking, and measurement precision - Findings: - The authorities have not adopted ECB’s guidance for minimum P2R capital add-ons per SREP score. - Reviewed P2R add-ons exhibit an artificial accuracy (e.g., add-ons with 2 decimal place accuracy such as 0.07 or 0.47 percent) considering uncertainties and approximations involved. - For smaller institutions concentration risk might be very relevant, but the authorities do not have an internal benchmarking framework or methodology for assessing how institutions take concentration risk into account in their ICAAP. - Recommendation: - Reassess P2R add-on methodology and precision; consider establishing benchmarking frameworks for concentration risk assessment. ### Reliance on External Auditors (EAs) and supervisory verification depth - Findings: - German authorities place great reliance on the work of the External Auditor (EA) to determine compliance with MaRisk requirements; EAs formulate an opinion captured in the “long-form report”. - The 2016 FSAP recommended placing greater emphasis on the ability to verify the reliability, accuracy and integrity of information used for risk assessments and prudential outcomes. - German authorities supervise 1,324 LSIs (and close to 600 other institutions covered by the BSD), creating a reliance on EAs for coverage. - For LSIs with a SREP score of 3 or 4 and on a sample basis for other LSIs, supervisors need the ability to challenge the work of the EA or to confirm/deepen the supervisory view. - On-site inspections may not go to necessary depth to verify on a credit file basis if practices align with policies; significant weaknesses observed in review of related and connected party transactions. - The capacity to perform deep dives/reviews of credit files is critical to conclude on the overall impact on the risk profile, including assessing risk appetite, board-approved risk limits, concentrations, large loans, connected loans and related party transactions. - Recommendations and actions: - Supervisors should be able to challenge EA work and undertake in-depth supervisory reviews (e.g., credit file level) for higher-risk LSIs. - Additional guidance to the MaRisk framework is necessary, specifically in relation to related and connected party transactions. - It is noted that new powers for BaFin to conduct forensic audits and the new enforcement unit regarding audited financial statements will help. ### Use of corrective and sanctioning powers; ladders of action - Findings: - BaFin has the necessary powers to undertake corrective action, but file reviews and discussions indicated a reliance on warning letters and delays in more proactive and effective supervisory actions. - Cultural change workstream of BaFin’s reorganization recognizes the need for more decisive supervisory action (see paragraph 20). - Recommendations: - BaFin should make earlier use of its available corrective and sanctioning powers. - Empower supervisors to make use of the newly recalibrated “ladders of action”. - Provide industry with clear and transparent guidance (e.g., “ladders of action”) reflecting BaFin’s ability to take corrective measures when certain conditions precedent exist. ### Guidance linking EBA Guidelines with MaRisk - Findings: - Additional guidance is necessary for the industry, EAs and internal supervisory staff to link EBA Guidelines with MaRisk requirements. - Reasons include: - EA MaRisk compliance reports vary in quality (German authorities have undertaken a joint working group to research how to address this). - MaRisk’s principle-based nature does not clearly outline BaFin’s supervisory expectations in certain risk areas linking to EBA Guidelines (e.g., the need to track/aggregate related party transactions, expansion of operational risk points). - To rely on EA work, supervisors need tools to effectively challenge EA outputs. - Recommendation: - Issue additional guidance to clarify supervisory expectations and to provide tools to challenge EA outputs. ### Engagement with supervisory boards and governance oversight - Findings: - Annual discussions are generally held with members of the management board, while engagement with the supervisory board is very limited. - German regulators do not normally meet supervisory board members in annual discussions with LSIs; meetings tend to occur only when an LSI’s situation is problematic or at the initiative of the institution. - MaRisk requirements and on-site work cover supervisory board responsibilities to a very limited extent; performance evaluation of management or self-evaluation of supervisory board is not standard. - LSI supervisory board members often include local political representatives. - Recommendation: - At least two members of the LSI supervisory board should have increased contact with the German authorities. - Suggested contacts include the Chairman of the supervisory board and the Chair of the Audit Committee (or an “independent” member) meeting BaFin/BBk at completion of on-site examinations or during annual SREP discussions. - Allow supervisory board members to speak with authorities without management present and introduce at least a few independent board members to balance suitability criteria. ### Supervisory resources, capacity, and risk expertise - Findings: - Compared with SSM peer NCAs, the average off-site FTE-equivalent of time spent per LSI is relatively low: - 0.33 FTE/LSI (lowest ranked out of 21 NCAs) - 0.2 FTE/LSI for savings and cooperative banks - 2.6 FTE/HP LSI ranked 17th out of 21 NCAs - More than 55 credit institutions migrated from the UK to establish business operations in Germany due to Brexit. - Temporary approvals of models (trading book) were afforded to these migrating credit institutions to support timely licensing (models were not examined upon entry). - BaFin BSD is responsible for overseeing 600 other credit institutions, stretching overall supervisory capacity. - Recommendations: - Reassess adequacy of supervisory resources in light of: - Addition of credit institutions with market risk implications (e.g., due to Brexit); build market risk expertise (modeling/valuation, correct application of MR-SA). - Need to reassess the adequacy of the MEL, frequency of on-site inspections to cover large LSI (HI) and the need to conduct more in-depth file reviews (e.g., credit file basis). - Overall capacity given BaFin BSD’s responsibility to oversee 600 other credit institutions. ### Use of IPS insights - Findings: - IPSs oversee the financial health of member LSIs and could provide useful insight into inherent risk and quality of risk management policies and procedures. - Recommendation: - Contemplate utilizing IPS information (e.g., premium ratings reflecting an up-to-date risk profile) as IPSs often have greater direct contact with LSIs. ### Supervisory reporting, data collection, and granularity - Findings: - BBk collects a variety of data: quarterly financial data (nGAAP, mostly solo), supplemental information to the annual auditor’s report, reporting of large loans, ICAAP and ILAAP reporting, and data collection for Basel III/current regulatory projects. - BBk collects annual audited financial statement information (solo and consolidated) for both nGAAP (RechKredV) and IFRS (FINREP). - All credit institutions must submit data for ECB/SSM reporting (COREP and FINREP). COREP covers solvency, liquidity (LCR, NSFR, asset encumbrance), large exposures and leverage; FINREP contains financial statements and additional line item information. - Out of 1,324 German LSIs: - approximately 79.5 per cent report FINREP data points only; - 0.8 per cent LSIs report oversimplified; - 19.2 per cent LSIs report simplified; - only 6 LSIs report full FINREP. - The Phase 2 assessment of quantitative indicators for the SREP score is not impeded by the majority reporting FINREP data points only. - Analysis of regulatory data is hampered by lack of granular data in certain risk areas (credit, market risk, related party transactions). - A project to improve collection of more granular real estate financing data will be implemented in 2023. - BBk issued an ordinance to collect semi-aggregate data (distributions) regarding lending for acquisition of real estate, including: - number and amount of loans granted; - whether covered by debt insurance; - loan to value ratios; - debt servicing ratios; - debt to income; - some internal risk indicators. - Recommendations: - BaFin/BBk must continue to progress the collection of granular data for banking supervisory purposes. - a) Continue to progress the collection of granular data; b) Reassess adequacy of the scope and depth of data currently collected for banking supervision purposes. ### Digitalization and Fintech: landscape and monitoring - Findings: - Germany hosts the largest number of neobanks and related service providers in continental Europe. - Some of the largest Euro Area neobanks (licensed as CRR credit institution), providers of BaaS and core banking SaaS, and one of the largest European online securities brokers are based in Germany. - Germany licensed 3 crypto custodians and several others are in the application process to transition from registration to formal licensing. - Relatively large number of licensing applications are in process to become payments service providers (PSPs). - Business models often rely on outsourcing, third-party providers, and partnerships (distributed value chains). - Size of German market and availability of technical skilled staff have contributed to fintech development, notably in Berlin. - Incumbent banks increased digitalization efforts but legacy systems constrain efficiency gains (e.g., moving core banking to the Cloud). - Market fragmentation constrains digital-only banks from realizing single Euro Area market potential due to differing jurisdictional implementations (client identification, consumer protection, regulatory reporting, cloud outsourcing) and functional differences in IBANs. - Fintech data collection, forward-looking dynamic market monitoring and financial stability analysis need further development. - BBk’s Statistics Directorate ran a pilot to collect fintech data; first results indicated fintech size across sectors was relatively small at that time, but rapid growth suggests a need for structural data collection and dynamic monitoring. - Recommendation: - Develop a more structural approach to fintech data collection, financial stability analysis and forward-looking market monitoring to match quickly developing monitoring needs. *Source: IMF country report extract (provided content).* ### 65. In support of the single European market, the German authorities pro-actively ### 1deuea2022007 - 65. In support of the single European market, the German authorities pro-actively ### European legislative and regulatory context - Legislative and regulatory prudential frameworks for the financial sector are largely set at a Euro Area level. - Current important European proposals (published as part of the European Digital Finance Package in November 2020 but not yet enacted) include: - Markets in Crypto-Assets Regulation (MiCA), which covers crypto-asset systems not regulated by current EU regulations (e.g., by MiFID II and the Electronic Money Directive). - Digital Operational Resilience Regulation (DORA), which puts in place comprehensive operational resilience requirements for financial service providers. ### National supervisory approach to fintech and innovation - National Competent Authorities (NCAs) have taken a competition- and technology-neutral approach (e.g., same activity, same risk, same regulation) to the regulation of fintech. - In Germany: - New financial service providers that conduct activities for which a license is required must comply with the same rules as existing licensed institutions. - Regulation provides for some proportionality in application, particularly for smaller and non-complex entities. - BaFin did not set up a sandbox due to the absence of a competition or market development mandate and regulatory experimentation clauses. Instead, BaFin established in 2017 an “innovation hub” for: - market monitoring, - internal coordination of regulatory and supervisory initiatives (hub and spoke model), - market outreach. - BaFin is implementing further instruments to strengthen FinTech outreach, including: - structured in-depth workshops between BaFin and industry participants to communicate supervisory expectations at an early stage and enable discussions of selected cutting edge FinTech topics, - an internal innovation radar to introduce countermeasures to information deficits perceived by market participants into the strategic planning cycle. - Market participants perceive the authorities as more reactive than proactive in discussing new and innovative services and business models, despite efforts to increase capacity and outreach. ### Licensing, supervision, and crypto-asset regulation - BaFin and Bundesbank have adjusted supervisory approaches to: - deal with more complex business models, - require crypto assets service providers to be licensed according to the financial services they provide. - New Focus Units (see paragraph 19) allow for more intensive supervision of perceived higher-risk business models and rapidly growing financial institutions (e.g., neobanks). - New powers introduced with FISG (see paragraph 25) related to direct supervision of outsourcing and third-party service providers will strengthen supervision of distributed value chain business models. - Amendments to the KWG (implemented January 2020) require crypto asset service providers (e.g., brokerage, asset management, trading platforms) to be licensed. - The existing regulatory perimeter appears to currently capture all material active financial service providers using business models based on innovative technology (requires continuous monitoring). - On consumer protection, BaFin has: - issued several warnings against trading in crypto assets, - actively monitors the market for unauthorized service providers. - Footnote data points: - BBk’s 2020 survey indicated less than 7.5 percent of survey participants having traded at least once in crypto assets. - At the time of the FSAP, payment service providers regulated under the Payments Services Supervision Act (ZAG) had 48 applications for licensing or registration as of early 2022; crypto custodians regulated under the Banking Act (KWG) were also a focus. ### Resourcing and supervisory expectations - Authorities need to devote sufficient and qualified resources and be transparent on supervisory expectations for new fintech business models and services. - The number of license applications from new entrants using innovative business models, in combination with the inflow of new entrants as a result of Brexit (see paragraph 56), requires specialized knowledge and resources to: - process applications in a timely manner, - ensure effective day-to-day supervision. - Know-how related to new technology and innovative business models relying on a distributed value chain is increasingly important. - Assessment of necessary skills for executive and supervisory board members will need to be part of licensing approval processes. - Clear communication of licensing approval requirements and supervisory expectations is key to support efficiency and effectiveness of supervisory processes. ### Digitalization of supervisory processes and tools - BaFin and Bundesbank (BBk) should continue efforts to improve data exchange including sharing of tools for banking supervision. - Joint digitalization agenda: - Was put on hold early 2021 and is currently being restarted. - Consists of 7 workstreams, including one workstream covering exchange of data between BaFin and BBk. - Authorities have chosen to focus on efficient exchange of data including shared use of tools and other services rather than developing common data warehouses, systems and tools. - This approach is described as realistic and pragmatic given differences between authorities (e.g., main tasks of BBk and BaFin) and challenges such as sunk costs, coordination and budget issues. - Risk: disjointed views on the available data and information should be avoided; supervisory assessment of credit institutions should be based on one set of supervisory data. - Each authority has internal digitalization strategies: - Digitalization of internal workflows and remaining paper-based processes is high on both agendas to free up resources for higher value-added work. - Work is ongoing to store and retrieve data more optimally and apply new analytical tools using artificial intelligence to analyse unstructured data. - The FSAP welcomes ongoing work in these areas. ### Financial Soundness Indicators for Banks, 2015–2020 (selected exact figures) - Capital adequacy — Regulatory capital to risk-weighted assets: - 2015: 18.3 - 2016: 18.8 - 2017: 19.4 - 2018: 18.9 - 2019: 18.6 - 2020: 19.2 - Regulatory Tier I capital to risk-weighted assets: - 2015: 15.7 - 2016: 16.3 - 2017: 16.9 - 2018: 16.6 - 2019: 16.5 - 2020: 17.2 - Sectoral distribution of loans to total loans — Loan to households: - 2015: 29.0 - 2016: 28.5 - 2017: 28.6 - 2018: 29.1 - 2019: 29.5 - 2020: 28.4 - Loans to non-financial corporations: - 2015: 15.2 - 2016: 14.9 - 2017: 15.1 - 2018: 15.7 - 2019: 16.1 - 2020: 15.4 - NPLs to gross loans: - 2015: 2.0 - 2016: 1.7 - 2017: 1.5 - 2018: 1.2 - 2019: 1.1 - 2020: 1.7 - NPLs net of provisions to capital: - 2015: 17.4 - 2016: 14.7 - 2017: 11.9 - 2018: 9.1 - 2019: 6.8 - 2020: 6.2 - Liquidity — Liquid assets to total short-term liabilities: - 2015: 146.5 - 2016: 146.6 - 2017: 151.3 - 2018: 151.7 - 2019: 161.2 - 2020: 169.6 - Sensitivity to market risk — Net open positions in FX to capital: - 2015: 4.6 - 2016: 4.0 - 2017: 3.7 - 2018: 3.2 - 2019: 3.7 - 2020: 3.4 - Source of table: Deutsche Bundesbank. The authorities provide annual data only and disseminate them once a year. ### Basel Core Principles (BCP) — Selected recommendations and implementation updates - BCP1 — Responsibilities, objectives and powers: - Recommendation: Ensure new consumer protection responsibilities do not affect BaFin’s ultimate responsibilities for safety and soundness. - Update: BaFin’s overarching cross-sectoral consumer protection mandate is stipulated in Section 4 Para (1a) of the Act Establishing the Federal Financial Supervisory Authority (FinDAG). Different objectives are the responsibility of different departments each with their own Executive Director; conflicts of interest are discussed at Board level. Assessors’ comments: the current setup should allow BaFin to deal effectively with potential conflicts of interest. - BCP2 — Independence, accountability, resourcing and legal protection for supervisors: - Recommendation (a): Reduce scope for potential influence of industry and government in the execution of supervisory priorities and allocation of resources at BaFin through budget and organizational structure. - Update (a): BaFin considers it free from external political interference but remains subject to legal and technical oversight of the MoF. BaFin’s President was provided additional powers effective July 1, 2021; however, the Executive Board that approves BaFin’s budget includes government representatives and experts from industry and academia chosen by the MoF in consultation with associations of supervised entities. Assessors’ comments: the change in powers of the President did not affect potential for external influence through the Administrative Council or the Ministry of Finance (see also paragraphs 12 and 13). *Source: IMF staff summary of the cited PDF content.* ### Appendix I. Progress on Implementing ### Appendix I. Progress on Implementing the BCP Assessment Recommendations (2016) ### BCP4 — Streamline SSM decision making processes for supervisory measures - Implementation update: - The Governing Council is the final decision-making body of the ECB according to the European Treaties. - ECB reviewed the five existing delegation schemes based on practical experience since initial adoption. - Delegation to ECB senior management was extended to certain decisions (e.g., internal models and the extension of deadlines). - Additional amendments aiming at further efficiency and simplification of decision-making are under way. - Assessors’ comments: - While the provided feedback appears to address the recommendation, a review of the timeliness of SSM decision making was not in scope of the current assessment. ### BCP5 — Licensing criteria - Recommendation elements and implementation: - (a) Include systemic analysis of availability of additional resources in the licensing process - Section 33 (1) (no 3) of the KWG was amended to indicate that BaFin may reject a license application if the owners of a qualifying holding do not have sufficient financial soundness or the ability to supply the institution with additional resources. - Assessors’ comments: file review indicated that the assessment of additional resources is part of the license application review. - (b) Include systematic analysis of the collective knowledge of the management and of the supervisory board - BaFin issued a guidance notice, pursuant to the 2020 amendments of the KWG and KAGB to require management and supervisory boards to have specific skills and capabilities that enable the boards as a whole to fulfill the function of the board, with the emphasis of the collective suitability. - Assessors’ comments: this addresses the recommendation. - (c) Enhance qualification criteria for supervisory board members - BaFin issued guidance regarding stricter requirements for the fit and proper assessment in terms of qualification criteria for supervisory board members. - Assessors’ comments: this addresses the recommendation. ### BCP7 — Major acquisitions - Implementation update: - German Federal Parliament views acquisitions in other entities as part of a business decision of an institution and does not see the need for ex-ante supervisory (dis)approval for major acquisitions. - No European provisions currently require such ex-ante procedures to exist; consequently, no changes in German laws, regulations or guidelines concerning major acquisitions have been made. - If an acquisition triggers a qualifying holding procedure in a Member State, the national competent authority would have to consult BaFin. - Assessors’ comments: - The same concerns as included in the 2016 assessment remain. ### BCP8 — Supervisory approach - Implementation update: - Since the 2016 FSAP, BaFin/BBk increased minimum engagement with credit institutions through annual dialogue with management, analyzing financial statements and conducting on-site inspections. - Improvements to inspection scopes and techniques in areas of risk provisioning (PAAR); business model analysis; IT and cyber risk, data aggregation and outsourcing. - New units established: greater scrutiny of credit institutions with complex business models, weak or problematic institutions, a new forensic audit group, and a unit to examine balance sheets of supervised entities. - Authorities are re-assessing reliance on the EA. - Assessors’ comments: - Acknowledge recent changes and diversification of off-site information sources. - Refer to TN commentary on additional work needed regarding reliance on external auditors (EA), supervisors’ ability to challenge EA work (e.g., deeper dives on credit file reviews), and reassessing adequacy of minimum supervisory engagement levels and frequency of on-site inspections in light of SSM reclassification of High-Risk and High-Impact LSIs (e.g., providing adequate coverage of on-site inspections for LSI’s with >€15Bn total assets). ### BCP9 — Supervisory techniques and tools - Implementation update: - BaFin/BBk rolled out the ECB/SSM LSI SREP methodology (2020) and updated supervisory documentation to map German supervisory activities/processes to the SSM SREP methodology. - Introduced minimum engagement level (MEL), classified LSIs as high priority or non-high priority, established intensified supervision and focused supervision units, and an enforcement unit to assess the quality of institutions’ financial statements. - Key quantitative risk indicators are assessed as part of Phase 2 of SREP and will be assessed quarterly going forward. - Institutions’ ICAAP and ILAAP assessed annually (with capital add-ons allocated annually or bi-annually depending on the SREP score). - BaFin/BBk are re-assessing adequacy of MEL framework and minimum frequency of on-site inspections. - Assessors’ comments: - This addresses the recommendation. ### BCP10 — Supervisory reporting - Recommendation elements and implementation: - (a) Collect more granular data as part of routine supervisory reporting to strengthen off-site analysis using peer group benchmarks - ECB published Regulation (EU) 534/2015 (amended in 2017 to apply to LSIs from 2019) which extends FINREP to supervised groups applying national accounting rules (nGAAP). The majority of LSIs report FINREP data points only. - Assessors’ comments: acknowledge progress; refer to report for need to continue collecting adequate granular data. - (b) Implement a data mapping solution to compare IFRS and nGAAP supervisory data - Majority of German institutions report based on German GAAP and report FINREP data in accordance with ITS on supervisory reporting and national FINREP instructions. - German nGAAP based FINREP reports are in principle based on the EBA reporting templates; national instructions contain intended mapping methods and guidance on specific reporting issues. - Assessors’ comments: this addresses the recommendation. ### BCP14 — Corporate governance - Implementation update: - BaFin’s guidance notice on administrative and supervisory boards pursuant to KWG and KAGB was changed in 2020 to address: stricter requirements for fit and proper assessments, collective suitability, independence of mind (assessment criteria regarding conflict of interest), and evaluation/ongoing monitoring of performance. - MaRisk updated in 2017 to reflect changes requiring quarterly/annual information from control functions (head of risk control, compliance and internal audit) and ex-ante notification if the head of one control function is removed. - Assessors’ comments: - Refer to TN and Appendix II stating the supervisory board role needs strengthening by: addition of independent board members (to lead committees as well), direct reporting line of control functions and overall need for the dual board system in Germany to be modernized in accordance with international standards and best practices. ### BCP15 — Risk management process - Recommendation elements and implementation: - (a) Strengthen reporting lines of the CRO and risk control function to the supervisory board - Risk control function continues to report directly to the management board. - Supervisory board can request information from the risk control function at any time or speak with this representative, but the management board will always be notified. - Assessors’ comments: although situation somewhat improved, the essence of the 2016 recommendation is not addressed. - (b) Implement a prior notification requirement to the supervisory board in the event a CRO is removed - 2017 MaRisk revision requires institutions to notify the supervisory board ex-ante in due time if the head of the risk control function is going to be replaced together with reasons for the intended replacement. - Assessors’ comments: ex-ante notification is in place but does not give the supervisory board power to stop such replacement if it deems necessary. ### BCP18 — Problem assets, provisions and reserves - Implementation update: - BaFin issued circulars on: definition and classification of a default (2019-04-16); additional FAQs during the pandemic on classification and provision aligned with ECB communication (2020-12-17); non-performing loan re-classification, valuation and provisioning and treatment of forbearance (including updating MaRisk to reflect EBA guidelines). - BaFin not empowered to publish guidance on accounting practices but established internal guidelines for on-site inspections; PAAR inspections manual updated describing supervisory stance on default classification, collateral valuation and provision at LSI on-site inspections. - Assessors’ comments: - This addresses the recommendation. ### BCP19 — Concentration risk and large exposures limits - Recommendation elements and implementation: - (a) Issue guidance on management of concentration risk in a broader sense (beyond credit exposures) - MaRisk provides principles-based guidance that banks ensure material risks, taking into account risk concentrations, are covered by available capital; ICAAP instructions require considering nature, scale and complexity and monitoring large exposure limits over at least a 3-year term. - Assessors’ comments: principles-based guidance exists but EAs, industry and supervisors would benefit from complementary guidance to clarify supervisory expectations; authorities lack an explicit framework/methodology to review concentration risk as part of ICAAP and assessment of the P2R. - (b) Introduce requirements that all material concentrations be regularly reviewed and reported to the bank’s supervisory board - MaRisk revision dated August 2021 requires management board to obtain reports on the risk situation, including existing material risk concentrations and provide quarterly reporting to the supervisory board. - Assessors’ comments: this addresses the recommendation. - (c) Monitor large exposures beyond compliance with LE limits - EBA issued guidelines on prudent and consistent assessment of large exposures breaches (to be applied from January 2022). - German supplementary requirements to large exposure rules formulated in “The Regulation Governing Large Exposures and Loans of €1Mn or more”, including supplemental provisions to section 14 of the KWG concerning recording, measurement and reporting of loans of €1Mn or more. - Assessors’ comments: this addresses the recommendation. ### BCP20 — Transactions with related parties - Implementation update (partial text available): - KWG updated to include: - section 15(6) of the KWG amended to expand the definition of related party transactions to include not only loans but other transactions like service contracts, asset purchases and sales and construction contracts; - adult children and parents of potential related party individuals pursuant to [text cut off in source excerpt]. *Source: Appendix I. Progress on Implementing the BCP Assessment Recommendations (2016).* ### section 15(1) no. 5, 12 of the KWG, and c) a new sentence 2 section 15(1) requiring management and ### 1deuea2022007 - section 15(1) no. 5, 12 of the KWG, and c) a new sentence 2 section 15(1) requiring management and ### Related party transactions and conflicts of interest - New sentence 2 to section 15(1) requires management and supervisory board members who have a conflict of interest to not participate in the preparation or adoption of resolutions concerning related party transactions. - Assessors’ findings: - The definition of a related party transaction has been adequately expanded. - There is no requirement to manage and monitor (e.g., set internal limits, aggregate and report) related party transactions. - Assessors refer to further commentary in the TN. ### BCP21 — Country and transfer risk: guidance, reporting, provisioning - Recommendation summary: - (a) Issue guidance on management of country and transfer risk including requirements for banks’ MIS and specific requirements for country and transfer risk to be included in bank’s stress testing if applicable. - (b) Enhance reporting of country and transfer risk. - (c) Issue guidance on provisioning and mitigation for country risk. - Implementation (a): - MaRisk: institutions must identify, aggregate, monitor and mitigate all material risks (with the addition “including country risk”). - ICAAP: requirements to account for material risks in the ICAAP; Section 2.2 MaRisk accounts for country risk as part of credit risk, aligned with EBA guidelines and the SSM methodology. - Institutions must assess and identify all aspects material to the counterparty and credit risk of the credit exposure. - Assessors’ comment: MaRisk and ICAAP provide some principles-based guidance, but industry would benefit from additional specific guidance on management of country and transfer risk and specific stress testing requirements (not general guidance). - Implementation (b) — reporting: - MaRisk introduced reporting requirements in 2017, defining banks’ MIS and requirement to monitor country risk exposure. - A risk report on counterparty and credit risk containing main structural features of credit business including country exposure and a separate analysis of country risk shall be drawn up and made available to the management board periodically at ease once a quarter. - Institutions are expected to carry out appropriate regular and ad hoc stress tests regarding material risks; 2017 MaRisk clarified that these tests shall be carried out in respect to the institution’s overall risk profile. - Assessors’ comment: this addresses internal reporting requirements for the institution and not necessarily reporting to the German authorities. - Implementation (c) — provisioning: - Country risk provisioning must be calculated individually by banks in accordance with the general valuation rules applicable under commercial law. - Institutions shall define criteria on the basis of which, taking due account of the accounting standards used, country risk provisions shall be formed (MaRisk). - Assessors’ comment: provisioning requirements are set by accounting standards and commercial law valuation rules; industry would benefit from complementing guidance. ### BCP24 — Liquidity risk: industry benchmarks and monitoring - Legal and regulatory measures: - The CRR transposes the Basel III Framework into law and transposes the Liquidity Coverage Ratio (LCR) — fully implemented since 2018 — and the Net Stable Funding Ratio (NSFR) — binding since 28.06.2021 (the first reporting date is 30.06.2021 with the remittance date of 12.08.2021). - CRR Article 415 3 (b) provides additional monitoring metrics for supervision of liquidity risks; reported depending on size and risk profile on a monthly or quarterly basis since 2016. - Since 2016 the qualitative requirements regarding liquidity risk management (MaRisk) have been amended twice; stress testing for capital markets oriented banks has been refined. - Key indicators and practices: - Short term liquidity risk is monitored by the LCR and the LCP (liquidity capacity period). - Indicators for funding sustainability risk include the NSFR and the 2-year contractual gap to total assets. - German SREP aligned with SSM LSI SREP methodology and includes a dedicated score for the credit institution’s ILAAP within annual liquidity risk assessment. - Observations: - IMF (German FSAP 2016) noted the EU LCR has elements less stringent than Basel (wider HQLA definition). - BaFin analysis: for German banks there is almost no impact from these deviations; liquidity buffers predominantly central bank reserves, coins and notes and high-quality government bonds — all eligible Level 1 HQLA per Basel LCR framework. - The share of other HQLA is below Basel LCR thresholds. - All Level 1 HQLA account for over 90% of total HQLA held by German banks. - Assessors’ comment: this addresses the recommendation. ### BCP25 — Operational risk: data collection and implementation assurance - Recommendation summary: - (a) Collect more granular data for operational risk. - (b) Place more emphasis on confirming that operational risk management systems are effectively implemented. - Implementation (a) — data: - Collection of loss data, its scope and granularity defined in EBA’s ITS on Supervisory Reporting (latest version). - German supervisors’ influence is limited to EBA membership; national measures beyond harmonized level would create burden and conflict with proportionality principle. - German authorities work to influence European process to increase scope and granularity of data collection; BaFin avoided national “gold plating”. - Assessors’ comment: acknowledge EBA constraints and that German institutions are required to keep operational loss data for their own purposes. - Implementation (b) — assurance: - Operational risk management assessed in conjunction with other risk types; MaRisk audits and ICAAP/SREP audits evaluate qualitative and quantitative elements. - Majority of institutions consider BIA capital requirements sufficiently conservative. - One of the two largest “Verbünde” developed a pillar II applied by a triple digit number of institutions. - BaFin intends to conduct an onsite inspection with a sample institution (postponed due to Covid; to be planned in coming year). - Assessors’ comment: commitment to future on-site inspections acknowledged. ### BCP26 — Internal audit reporting independence - 2017 changes to MaRisk provide for quarterly reporting from the IA function to the supervisory board; these reports are first presented to the management board (no changes permitted to the report and without significant delays). - Compliance function must provide reports to the supervisory board at least annually. - Assessors’ comment: internal audit function remains unable to report directly and independently to the supervisory board without management oversight. ### BCP27 — Financial reporting and external audit access - Legal change: - In 2020, section 29(3) sentence 2 of the KWG was amended to allow the banking supervisor to gain more detailed information from the external auditor. - Assessors’ comment: - German authorities rely extensively on external auditors’ work (reliance is being re-assessed by authorities). - Gaining access to external auditor (EA) working papers would improve BaFin’s ability to challenge and obtain assurance on EA work. - In absence of this power, authorities should assess their ability and enhance capacity to challenge EA work through other means. ### BCP29 — Abuse of financial services / AML/CFT supervision - BaFin actions since 2017: - Regular on-site AML inspections; intervals, selection, team sizes and duration/intensity based on AML supervisory strategy and institution risk profile. - Use of external auditors to confirm institutions’ compliance with AML requirements. - Annual audit reports submitted electronically to BaFin via MVP reporting platform since 2019 and processed within BaFin’s risk profiling system Bakis; reports include detailed data sheet with comprehensive information on ML/TF risks and evaluation of control quality. - 2019 amendment to audit report regulation adjusted requirements for annual reporting of external auditors, particularly for information relevant to determining inherent AML risk. - Professional auditors/accountants conduct AML/CFT specific annual audits and must follow the International Code of Ethics for Professional Accountants; preventive supervision by chambers of accountants includes mandatory quality controls of statutory auditors/accountants. - Since 2017 BaFin increasingly used “Support for audits of annual financial statements” — a BaFin supervisor accompanies the auditor during the audit. - Institutionalised exchange format with the Institute of Public Auditors in Germany (IDW) since 2016 for communicating supervisory expectations and guidelines. - Since 2016 BaFin has increasingly communicated interpretations bilaterally to auditors on fundamental legal issues. - Assessors’ comment: BaFin relies on external auditors for majority of institutions’ AML/CFT compliance; on-site inspections are carried out on a risk basis; recommendation addressed. ### Appendix II — The German Corporate Governance Framework (selected points) - General framework: - Germany has a dual board model: an (executive) management board and a (non-executive) supervisory board. - Corporate governance of German stock corporations (“Aktiengesellschaft”, “AktG”) determined by statutory law and non-binding best practice rules; AktG sets largely mandatory framework. - German Corporate Governance Code sets non-binding recommendations for listed companies and companies with access to capital markets. - Role of the supervisory board: - Unlike Basel Corporate Governance Principles, supervisory board in Germany has no decision-making role in approval of key policies pertaining to risk appetite, CAAP, capital and liquidity plans, compliance policies, internal control system, or setting corporate culture and values. - Supervisory board supervises and advises management board; entitled to request reports; cannot make executive decisions or give formal orders to management board. - Supervisory board responsibilities include (select): - Appoint and dismiss management board members; - Approve selected management board decisions (e.g., related party transactions or matters defined in articles of association); - Monitor and evaluate management board performance; - Determine management board compensation and employment contracts; - Monitor compliance in all respects; - Nominate and, after shareholders meeting approval, engage the company’s auditor and inspect annual financial statements; - Request reports and oversee shareholder/stakeholder interests. - Supervisory board reporting and control-function access: - MaRisk contains limited explicit requirements for supervisory board functioning; mainly concerns regular reporting and right to request more information from control functions (same information shared with management board). - KWG: chair of risk committee or audit committee (or chair of supervisory board if no committees) may make direct enquiries to head of internal audit and head of risk control unit. - FISG (recently adopted): audit committee of supervisory board of public interest entities (including credit institutions) entitled to directly request information from key function holders relevant for compliance and accounting without obligation to share obtained information with management board, although management board must be informed about the request. - Practical effect: control functions do not have an unimpeded direct reporting relationship with the supervisory board. - EBA Internal Governance Guideline adoption: - Germany partially adopted EBA Guideline on Internal Governance (EBA/GL/2017/11) and declared non-compliance with requirement for having independent supervisory board members. - BaFin published December 2020 revised Guidance Notice on Management Board Members and Guidance Notice on Members of Administrative and Supervisory Bodies addressing notification requirements, collective suitability, conflict of interest assessment (independence of mind), obligations of management board members (suitability, diversity, training, dealing with conflicts of interest), and staffing of key functions. - Both guidance notices refer to principle of proportionality and include exceptions/adjustments depending on size, organization, nature and complexity. - Role of independent members: - OECD and BCBS recognize independent non-executive and supervisory board members as key to strong corporate governance and effective oversight. - Many jurisdictions have adopted independence requirements; Germany declared non-compliance with EBA requirement for independent supervisory board members. *INTERNATIONAL MONETARY FUND — GERMANY (excerpt).* ### 8. Within the SSM, Germany appears to be among the outliers with no or very weak ### 8. Within the SSM, Germany appears to be among the outliers with no or very weak supervisory expectations for independent board members. ### Compliance with EBA Guidelines - Of the 27 jurisdictions participating in the SSM, only 6 (Belgium, Germany, Hungary, Estonia, Netherlands and Slovakia) have declared (partial) non-compliance with the EBA Guideline on Internal Governance. - The other 21 countries either comply or intend to comply with the EBA requirements for independent board members. - A review of published documents indicated that of the countries that have declared (partial) non-compliance at least Belgium (single board system) and the Netherlands (dual board system) have issued supervisory guidelines including expectations on the requirement for independent board members. ### Independence of board members and "independence of mind" - Independent members are not strictly required in Germany, but: - The AktG and the Corporate Governance Code contain requirements regarding the narrower concept of “independence of mind.” - BaFin has issued specific independence of mind criteria for supervisory board members of credit institutions. - Independence of mind in the German context focuses on the narrower concept of dealing with conflicts of interest in individual cases. - The Corporate Governance Code recommends that the supervisory board should include an appropriate number of independent members; however: - The Code is only applicable to listed companies (and most LSIs are not listed). - According to the Corporate Governance Code, a member of the supervisory board is considered independent if it is independent of the company and its management board and a shareholder that controls the company. - The chair of the supervisory board, the chair of the audit committee and the chair of the committee responsible for the compensation of the management board should be independent of the company and the management board. - Listed companies and certain other companies have to comply with these requirements or explain why they don’t comply. ### Key function holders and access to the supervisory board - Germany deviates from the EBA Guideline on Internal Governance with respect to key function holders. - Definition/context: - Key function holders are responsible for key internal control functions (e.g., head of internal audit, head of risk, head of compliance, head of finance), but are not part of the management body. - EBA Guideline requirement (quotation preserved): - “the heads of internal control functions are able to act independently and, regardless the responsibility to report to other internal bodies, business lines or units, can raise concerns and warn the management body [in the case of Germany the management board] in its supervisory function directly [in the case of Germany to the supervisory board], where necessary, when adverse risk developments affect or may affect the institution.” - German practice: - The German framework does not provide key function holders with direct uncensored access to the supervisory board without a request also being provided to the management board (as discussed above in paragraph 5). ### Fit and proper requirements - Germany declared non-compliance with the EBA fit and proper requirements for key function holders. - German authorities’ view: - Authorities have expressed the view that these requirements are not proportional and have therefore also declared (partial) non-compliance with the EBA/ESMA Guideline “on the assessment of the suitability of members of the management body and key function holders.” - Practical consideration and possible change (quotation preserved): - “Recognizing the practical supervisory resource implications (as a result of the large number of supervised entities) of adopting the Guideline and proportionality considerations, the current framework could be strengthened to place the responsibility for the fit and proper assessment of y function holders with the supervisory board instead of with the management board. This would however imply material changes in the distribution of responsibilities between the management board and the supervisory board as currently reflected in the German corporate law framework.” ### Conclusion and governance implications - Germany’s corporate governance framework for banks deviates from international best practices. - EBA Guidelines are based on and in line with the international best practices as described in the OECD and BCBS corporate governance principles. - EBA Guidelines are not “hard” requirements for the SSM member jurisdictions but are governed by a comply and explain mechanism. - Germany has declared partial non-compliance with important elements of the EBA guidelines for internal governance and fit and proper requirements. - Because of these deviations, Germany’s framework appears to leave room for dominant CEO’s and/or management boards that dominate key control functions. *Source: IMF staff text from content unit 1deuea2022007 (excerpt).* --- _Source: https://www.imf.org/-/media/files/publications/cr/2022/english/1deuea2022007.pdf_