Germany’s financial sector faces stricter outsourcing rules

Last year’s Wirecard scandal send shockwaves across Germany and to the political heart of Berlin. EUR 1.9 billion were lost in just one night followed not just by the historically first insolvency of a Dax-listed company (Dax is Germany’s prime stock index) but also by a deep blow to trust in Germany’s financial market. The Federal Ministry of Finance is engaged in damage control ever since, trying to regain the trust that was lost. One of the tools to do that is a bill to strengthen financial market integrity. The draft presented by the Federal Ministry of Finance has already advanced to become a bill sponsored by the Federal Government which was presented on 16 December 2020. The proposed measures include enhanced financial reporting and further regulation of annual audits to guarantee correct reporting and financial statements (see our client alert here). At the same time, structural dimensions and enforcement authority of financial regulator BaFin were identified for reform.

Changes to the legal setting of outsourcing are addressed by amendments to the German Banking Act (Kreditwesengesetz – KWG), the Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz – ZAG), and the Capital Investment Code (Kapitalanlagegesetzbuch – KAGB). Central to the reform are new disclosure and reporting obligations for outsourcing institutions as well as for institutions taking up the outsourced tasks (outsourcer). According to the bill, regulatory measures will become directly applicable to outsourcers. The proposed amendments are essentially parallel in all three to-be-amended acts.

1. The Definition of the Outsourcer

To provide legal certainty both KWG and ZAG shall be amended to include each a specific definition of the term outsourcer. Outsourcers according to section 1 para. 10 KWG-E and section 1 papa. 10a ZAG-E (-E signaling the status of a bill) are companies to which an institution or a superordinate company has outsourced activities and processes for the execution of banking business, financial services, payment services, e-money business or other services typical to the institution, as well as its subcontractors in the case of the further outsourcing of essential activities and processes for the execution of banking business, financial services, payment services or e-money business or other services typical to the institution. To include a legal definition of these outsourcers is relevant as the basis for a direct regulatory and enforcement authority of BaFin vis-à-vis these outsourcers must come with the necessary legal certainty.

The current definition originating in section 44 para. 1 sentence 2 KWG only covered essential outsourcing without the scope to apply to the entire KWG. ZAG so far does not know any legal definition of outsourcers.

2. Regulatory enforcement vis-à-vis outsourcers

BaFin is set to receive a significant expansion of its competencies when dealing with outsourcers (see section 7, para 2 sentence 5 KWG-E). KWG, ZAG and KAGB will be amended to include authorization for BaFin especially regarding the issue of orders towards outsourcers. BaFin can take the initiative to prevent or stop breaches of regulatory requirements (see section 25b para. 4a KWG-E; section 26 para. 3a ZAG-E). According to these provisions, BaFin will be authorized to intervene to prevent and eliminate deficits capable to affect either the security of the assets entrusted to the outsourcer or the orderly conduct of banking business, financial services, payments services or e-money business.

Even in the case of an improper business organization, up to now BaFin only had the competence to address the outsourcing institution, not the outsourcer itself. The bill to amend KWG and ZAG proposes change this (see section 45b papa 3 KWG-E; section 27 para 3 sentence 3 ZAG-E). BaFin will, following the adoption of the bill, be able to issue orders directly addressing the outsourcers to ensure a proper order of business. With regard to banking and financial services BaFin will additionally be authorized to enforce anti-money laundering regulations vis-à-vis outsourcers (see section 25h para 5 KWG-E).
A further set of powers for BaFin to address outsourcers are to be included in the KAGB. In the case of a threat to the orderly operations of a (AIF and UCITS) management company, BaFin can take measures to address involved outsourcers (see section 36 para 5a KAGB-E). The aim of this amendment is to prevent the respective management company to be merely a shell company.

3. Requirement to name a serviceable representative.

To ensure the proper application of the new framework to outsourcers located in third countries, the outsourcing institution are compelled to include in their outsourcing contracts that the respective outsourcer names a domestic representative (process agent) that is serviceable for BaFin (see section 25b para 3 sentence 4 KWG-E; section 26 para 1 sentence 7 ZAG-E; section 36 para 1 sentence 1 KAGB-E). The practice of enforceability of orders to outsourcers located in third countries is not further specified in the bill. An indirect approach addressing the outsourcing domestic institutions seems plausible. Further legal clarifications are however needed.

4. Intensified reporting obligations

A further pillar to the proposed set of amendments are intensified reporting obligations of outsourcers. So far, only ZAG and KAGB knew reporting obligations for outsourcing ambitions of payment services or e-money business and management companies, respectively (see section 28 para 1 nr 10 ZAG; section 36 para 2 KAGB). This obligation will, in a limited form, be applied to financial services institutions (see section 24 para 1 nr 19 KWG-E), for credit services institutions this reporting obligation only applies to the outsourcing of essential services. This includes the duty to report essential changes and significant events in the outsourcing. Payment services and e-money providers will have to meet this as a new requirement as well (see section 28 para 1 nr 10 ZAG-E). According to the KAGB-E only essential changes but no significant events must be reported (see section 36 para 2 sentence 2 KAGB-E).

KWG-E additionally introduces an obligation for outsourcers to present upon request information regarding all business dealings and records in the case they affect activities and processes outsourced by an institution or superordinate company (see section 44 para 1 sentence 1 KWG-E).

5. Conclusion

Through the proposed bill to strengthen financial market integrity, the German legislator specifically target outsourcers. To combat the evasion of domestic regulatory requirements through outsourcing the legislator employs tools of transparency and intervention powers. This includes new competences for BaFin to directly serve orders to outsourcers. Reporting requirements for institutions and outsourcers create the necessary transparency. The effect on outsourcers located in third countries will be a question for the regulatory practice.