German Banking Act
The German Banking Act is the national law that defines regulated banking business and financial services in Germany. It sets licensing requirements and rules for the organization and supervision of institutions. The law provides a framework for handling deposits, lending and other financial activities where customers entrust money or assets to a provider.
Banks and fintech businesses use the law to assess which activities require permission and how their operations must be organized. BaFin and the Deutsche Bundesbank share supervisory responsibilities under its provisions. Requirements for management and risk controls help institutions identify problems in their business and protect the interests of depositors and other creditors.
What the KWG regulates
The act took effect in 1935 and was rewritten in 1962, and it is the German implementation of the Basel accords from Basel I to Basel III. The German Banking Act's purpose is to keep banks working and to protect creditors from losing their deposits.
Section 1 defines what is regulated. Section 1's list of banking business has twelve entries, among them deposit taking, lending, the safe custody of securities, guarantee business, underwriting and central counterparty services. Financial services add investment advice, portfolio management, proprietary trading, the operation of trading facilities and a qualified crypto custody business for cryptographic instruments and the private keys that control them.
The license under section 32
Anyone who conducts banking business or provides financial services commercially, or on a scale that needs a commercially organized operation, needs written permission from BaFin under section 32. The application proves the initial capital, names the managers and shows that they are reliable and professionally qualified, and contains a business plan with the types of business, the organizational structure and the internal controls. The license application also covers the significant shareholders. BaFin can attach conditions and can limit a license to single services.
For a fintech, the first question about a product with deposits, loans or client portfolios in it is whether the activity falls under section 1, and if it does, whether the firm applies for its own license or works under the license of a partner bank. Banking as a service in Germany allows a fintech to use the partner bank route.
Section 25a: how a bank must be organized
Section 25a requires a proper business organization, including business and risk strategies, procedures for risk-bearing capacity under stress, an internal control system with an independent risk control function and an independent compliance function, an internal audit, emergency management with a focus on IT systems, and a process that lets employees report violations while their identity stays confidential. The risks it names include ESG and concentration risks over the short, medium and long term.
BaFin spells these duties out in the MaRisk circular. Section 25b adds rules for outsourcing and cloud in German banks. The BAIT circular developed IT-specific requirements within this supervisory framework.
Upcoming events on risk and compliance
Who supervises banks under the German Banking Act?
BaFin and the Deutsche Bundesbank share the work under section 7. The Bundesbank runs ongoing supervision: it evaluates the documents and audit reports banks submit and assesses their capital and risk management. BaFin takes the supervisory measures, such as general orders and administrative acts, and usually bases them on the findings of the Bundesbank. For the largest banks, both authorities work within the single supervisory mechanism of the European Central Bank.
What does section 18 of the KWG require?
Section 18 requires a credit institution to have a borrower disclose its financial circumstances, mainly through annual financial statements, when a loan exceeds 1.5 million euros or 10 percent of the institution's tier 1 capital. The bank can waive this when collateral or co-obligors make the request obviously unfounded, and loans to central governments and central banks are exempt.
What is section 24c of the German Banking Act?
Section 24c obliges credit institutions to keep a file of every account and custody account with the holder's name, address and date of birth, the authorized persons and the beneficial owners. BaFin can query it automatically at any time, and the bank must not learn of the queries. The data is deleted ten years after the account closes. Prosecutors, customs and the financial intelligence unit can request information through BaFin.
The German Banking Act and Finance Loop
Finance Loop brings together the compliance officers, risk managers, lawyers and founders who deal with the KWG, from the license question of a new lending or payment product to the section 25a duties of an established bank. Finance Loop supports When Banks Say 'No', a compliance seminar in Frankfurt, and its events take place in Frankfurt, Munich, Berlin and Hamburg.
Finance Loop is a professional network supporting the institutional use of emerging technologies in finance, such as AI, digital payments, cloud and blockchain solutions. Finance Loop helps its members build skills and personal networks in these fields: Investment & Digital Assets, Payments & Digital Money, Digital Infrastructure & Sovereignty, and Risk & Compliance.