Final ESMA Guidelines on cloud outsourcing

At the end of December 2020, the European Securities and Markets Authority (ESMA) published its final report on its guidelines on outsourcing to cloud service providers (CSP). The purpose of the guidelines is to help firms identify, address and monitor the risks that may arise from their cloud outsourcing arrangements. Since the main risks associated with cloud outsourcing are similar across financial sectors, ESMA has considered the European Banking Authority (EBA) Guidelines on outsourcing arrangements, which have incorporated the EBA Recommendations on outsourcing to cloud services providers and the European Insurance and Occupational Pensions Authority (EIOPA) Guidelines on outsourcing to cloud service providers. This ensures consistency between the three sets of guidelines. The ESMA Guidelines on cloud outscoring apply to MiFID II firms such as investment firms and other financial services providers indirectly but they describe the market standard and set the supervisory framework for the National Competent Authorities (NCAs) in Europe such as the German Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht – BaFin).

For the German jurisdiction, BaFin published guidance on outsourcing to cloud providers back in 2018. Please note that the amended MaRisk include outsourcing requirements for investment firms and other financial services providers and already reflect the EBA Guidelines on outsourcing, including cloud outsourcing. For more information on the MaRisk amendment, please see our previous Blogpost.

The guidelines in more detail

The following gives a brief overview of the main content of the ESMA cloud outsourcing guidelines.

  • Guideline 1: Governance, oversight and documentation

Firms should have a defined and up-to date cloud outsourcing strategy which should include, inter alia, a clear assignment of the responsibility for the documentation, management and control of cloud outsourcing arrangements, sufficient resources to ensure compliance with all legal requirements applicable to the firm’s outsourcing arrangements, a cloud outsourcing oversight function directly accountable to the management body and responsible for managing and overseeing the risk of cloud outsourcing arrangements, a (re)assessment of whether the cloud outsourcing arrangements concern critical or important functions as well as an updated register of information on all cloud outsourcing arrangements. For the outsourcing of critical or important functions, the ESMA guidelines include a detailed list of information which should be included in the register.

  • Guideline 2: Pre-outsourcing analysis and due diligence

ESMA provides information on what is required for the pre-outsourcing analysis (e.g. an assessment if the cloud outsourcing concerns a critical or important function). In the case of outsourcing of critical or important function, firms should conduct a comprehensive risk analysis and take into account benefits and costs of the cloud outsourcing and perform an evaluation of the suitability of the CSP.

  • Guideline 3: Key contractual elements

The guidelines provide a detailed list of what a written cloud outsourcing agreement should include in case of outsourcing of critical or important functions. Such agreements should include, inter alia, provisions regarding data protection, agreed service levels incident management, business continuity plans, termination rights and access and audit rights for the firm and its competent supervisory authority.

  • Guideline 4: Information security

Firms should set information security requirements in its internal policies and procedures and within the cloud outsourcing written agreement and monitor compliance with these requirements on an ongoing basis. In case of outsourcing of critical or important functions, additional requirements apply regarding information security organization, identity and access management, encryption and key management, operations and network security, application programming interfaces, business continuity and data location.

  • Guideline 5: Exit strategies

In case of outsourcing of critical or important functions, firms should develop and maintain exit strategies that ensure that the firm is able to exit the cloud outsourcing arrangement without undue disruption to its business activities and services to its client. Exit strategies should include comprehensive and documented exit plans, the identification of alternative solutions and provisions in the written outsourcing agreements that oblige the CSP to support orderly transfer of the outsourced function from the CSP to another CSP.

  • Guideline 6: Access and audit rights

Firms should ensure that the cloud outsourcing written agreement does not limit the firm´s and competent authority´s effective exercise of the access and audit rights on the CSP (see also Guideline 3). However, the Guideline also includes provisions aimed at reducing the organizational burden on the CSP and its clients when exercising access and audit rights: firm may use e.g. third-party certifications and external or internal audit reports made available by the CSP. However, in case of outsourcing of critical or important functions, the guidelines stipulate additional requirements that must be met in order to be able to rely on third party certifications or assessments.

  • Guideline 7: Sub-outsourcing

In case of sub-outsourcing, the firm should ensure that the CSP appropriately oversees the sub-outsourcer. In addition, ESMA provides information on the provisions that should be included in the written outsourcing agreement between the firm and the CSP in the case of sub-outsourcing critical or important function. This includes the remaining accountability of the CSP, a notification requirement for the CSP in case of any intended sub-outsourcing allowing the firm sufficient time to carry out a risk assessment of the proposed sub-outsourcer, the firm´s right to object to the intended sub-outsourcing and termination rights in case of such objection.

  • Guideline 8: Written notification to competent authorities

Firms should notify in writing its competent authority in a timely manner of planned cloud outsourcing arrangement that concern critical or important functions. The notification should include, inter alia, a description of the outsourced functions, a brief summary of the reasons why the outsourced function is considered critical or important and the individual or decision-making body in the firm that approved the cloud outsourcing arrangement.

What´s next?

In a next step, the guidelines will be translated in the official EU languages and published on the ESMA´s website. The publication of the translation will trigger a two-month period during which the national competent authorities must notify ESMA whether they comply or intend to comply with the guidelines (comply or explain mechanism). For the German jurisdiction, it is to be expected that BaFin will comply with the ESMA guidelines.

Benchmarks Regulation: Updated ESMA Q&A bring more clarity about input data used for regulated-data benchmarks

To provide benchmarks, administrators rely on input data from contributors. If the contributors are regulated, the benchmarks created with their data qualify as regulated-data benchmarks. The updated Question and Answers (Q&A) of January 30, 2019 from the European Securities and Markets authority (ESMA) provide, inter alia, answers to three questions regarding input data used for regulated-data benchmarks which have been raised frequently in the market (Q&A available here). This blogpost will present these questions as well as ESMA´s answers. Beforehand, it gives a short overview of the Benchmarks Regulation´s regulatory background and explains what input data means.

Regulatory background of the Benchmarks Regulation

Regulation (EU) 2016/1011 concerning indices used as a reference value or as a measure of the performance of an investment fund for financial instruments and financial contracts (Benchmarks Regulation – BMR) sets out the regulatory requirements for administrators, contributors and users of an index as a reference value for a financial product with respect to both the production and use of the indices and the data transmitted in relation thereto. It is the EU’s response to the manipulation of LIBOR and EURIBOR. The BMR aims to ensure that indices produced in the EU and used as a reference value cannot be subject to such manipulation again. In previous blogposts on the BMR, we have already dealt with the requirements for contingency plans and non-significant benchmarks (ESMA publishes Final Report on Guidelines on non-significant benchmarks- Part 1 and Part 2.)

Input data

For a benchmark to be created, the administrator, i.e. the person/entity who has control over the provision of the reference value, relies on data he receives from contributors. These data used by an administrator to determine a benchmark in relation to the value of one ore more underlying asset or prices qualify as input data under the BMR.

With this in mind, what are the market-relevant questions regarding input data that are answered in the updated Q&A by ESMA? 

  • Can a benchmark qualify as a regulated-data benchmark if a third party is involved in the process of obtaining the data?

Under the rules of the BMR, a benchmark only qualifies as a regulated-data benchmark if the input data is entirely and directly submitted by contributors who are themselves regulated (e.g. trading venues). Since the input data come exclusively from entities that are themselves subject to regulation, the BMR sets fewer requirements for the provision of benchmarks from regulated data than for other benchmarks. This precludes, in principle, the involvement of any third party in the data collection process. The data should be sourced entirely and directly from regulated entities without the involvement of third parties, even if these third parties function as a pass-through and do not modify the raw data.

However, if an administrator obtains regulated data through a third party service provider (such as data vendor) and has in place arrangements with such service provider that meet the outsourcing requirements of the BMR, the administrator´s benchmark still qualifies as regulated-data benchmark. The third party being subject to the BMR´s outsourcing requirements ensures a quality of the input data contributed by this third party comparable to the quality of the input data contributed by a regulated entity.

  • Can NAV of investment funds qualify as benchmark?

The net asset value (NAV) of an investment fund is its value per share or unit on a given date or a given time. It is calculated by subtracting the fund´s liabilities from its assets, the result of which is divided by the number of units to arrive at the per share value. It is most widely used determinant of the fund´s market value and very often it is published on any trading day.

But, according to the BMR stipulations, the NAVs of investment funds are data that, if used solely or in conjunction with regulated data as a basis to calculate a benchmark, qualify the resulting benchmark as a regulated-data benchmark. The BMR therefore treats NAVs as a form of input data that is regulated and, consequently, should not be qualified as indices.

  • Can the methodology of a benchmark include factors that are not input data?

The methodology of a benchmark can include factors that are not input data. These factors should not measure the underlying market or economic reality that the benchmark intends to measure, but should instead be elements that improve the reliability and representativeness of the benchmark. This should be, according to ESMA, considered as the essential distinction between the factors embedded in the methodology and input data.

For instance, the methodology of an equity benchmark may include, together with the values of the underlying shares, a number of other elements, such as the free-float quotas, dividends, volatility of the underlying shares etc. These factors are included in the methodology to adjust the formula in order to get a more precise quantification of the equity market that the benchmark intends to measure, but they do net represent the price of the shares part of the equity benchmark.

Upshot

The updated ESMA Q&A provide more clarity for market participants on the understanding of input data and its use for regulated-data benchmarks. ESMA´s input will facilitate dealing with the regulatory requirements of the BMR, at least with regard to input data.

ESAs publish joint report on regulatory sandboxes and innovation hubs – Part 2

On January 7th 2019 the European Supervisory Authorities (ESAs) (consisting of ESMA, EBA and EIOPA) published as part of the European Commission’s FinTech Action Plan a joint report on innovation facilitators (i.e. regulatory sandboxes and innovation hubs). The report sets out a comparative analysis of the innovation facilitators established to date within the EU including the presentation of best practices for the design and operation of innovation facilitators.

We take the report as an occasion to present both innovation hubs and regulatory sandboxes in a two-part article. After we highlighted innovation hubs in Part 1, Part 2 will shed some light on regulatory sandboxes.

Regulatory sandboxes – What they are and what their goals are

The EU Commission´s FinTech Action plan provides for regulatory sandboxes to create an environment in which supervision is specifically tailored to innovative firms or services. ESMA’s joint report follows on from the FinTech Action plan and investigates the previous equipment and experience with regulatory sandboxes.

In detail, a regulatory sandbox provides a scheme to enable regulated and unregulated entities to test, pursuant to a specific testing plan agreed and monitored by the competent authority, innovative financial products, financial services or business models under real regulatory conditions before they bring the products to market.

The aim of a regulatory sandbox is to provide a monitored space in which competent authorities and firms can better understand the opportunities and risks presented by innovations and their regulatory treatment through a testing phase. Also, firms can assess the viability of innovative positions, in particular in terms of their application of and their compliance with regulatory and supervisory requirements. However, regulatory sandboxes do not entail the disapplication of regulatory requirements that must be applied as a result of EU law. On the contrary, the baseline assumption for regulatory sandboxes is that firms are required to comply with all relevant regulatory requirements applicable on the activity they are undertaking. The main goal of the regulatory sandboxes, as with the innovation hubs, is therefore to enhance the firms’ understanding of the relevant regulatory issues and, on the other hand, to enhance the competent authorities’ understanding of innovative financial products.

Where they exist and who can participate

At the date of the ESA report, five competent authorities reported operational regulatory sandboxes: Denmark, Lithuania, Netherlands, Poland and UK. The sandboxes are open to incumbent institutions, new entrants and other firms. Moreover, the sandboxes are not limited to a certain part of the financial sector, rather they are cross-sectored (e.g. banking, investment services, payment services and insurances).

How does a regulatory sandbox work exactly?

Typically, regulatory sandboxes involve several phases which can be described as (i) an application phase, (ii) a preparation phase, (iii) a testing phase and (iv) an exit or evaluation phase.

Regulatory Sandbox

In the following, we briefly describe the steps taken in each phases either by the firm or by the competent authority.

Application phase

Firms interested in participating on a regulatory sandbox must submit an application by the competent authority. The applications received are judged by the competent authority against set, transparent, publicly available criteria. These criteria are, e.g. (i) the scope of the propositions, i.e. does the firm’s business model to be tested in the regulatory sandbox involve regulated financial services, (ii) the innovativeness of the firm’s proposition and (iii) the readiness of the firm to test its proposition. Whether the company is ready for a regulatory test phase in the sandbox is judged on the basis whether or not the firm has, e.g., developed a business plan or has obtained the appropriate software license.

Preparation phase

During the preparation phase, the competent authorities work with the firms deemed to be eligible to participate in the regulatory sandboxes to determine:

  • whether or not the proposition to be tested involves a regulated activity. If this is the case and the firm does not already hold the appropriate license, the firm will be required to seek the appropriate license in order to progress to the testing phase,
  • if any operational requirements need to be put in place to support the test (e.g. systems and controls, reporting),
  • the parameters for the test (such as number of clients, restrictions on serving specific clients, restrictions on disclosure),
  • the plan for the engagement between the firm and the competent authority during the testing phase.

Testing phase

The testing phase allows sufficient opportunity for the proposition to be fully tested and for the opportunities and risks to be explored. Throughout the testing phase, the firm is expected to communicate with the competent authority through a direct on-site presence, meetings, regulator calls or pre-agreed written reports. According the ESAs report, the supervision during the testing phase in a regulatory sandbox is experienced as a more intense supervision by the competent authority than the usual supervisory engagement outside the sandbox.

From the perspective of the competent authority, the value of the testing phase in the regulatory sandbox can be found in the opportunity to understand the application of the regulatory framework with regard to the innovative proposition and in the opportunity to built in appropriate safeguards for innovative propositions, for example with regard to consumer protection considerations. On the other hand, the value for the firms can be found in gaining better appreciation of the application of the regulatory scheme and supervisory expectations regarding the innovative propositions.

Evaluation phase

In the evaluation phase, the firm either submits to the authority a final report so that an assessment of the test can be carried out, or the competent authority will evaluate the success of the test by drawing on input provided by the firm. It should be noted that the test can be considered a success in many ways. Thus, not only the result that the product can be successfully established on the market under the tested regulatory conditions can be regarded as a success, but also the recognition that it is not possible for a proposition to be viably applied at the markets in the light of the existing regulatory and supervisory obligations.

Why is there no regulatory sandbox in Germany?

Unlike in Denmark, Lithuania, the Netherlands, Poland and the UK, the German Federal Financial Supervisory Authority (Bundesanstalt für FinanzdienstleistungsaufsichtBaFin) has not set up a regulatory sandbox in Germany. In the past, BaFin promoted the view that each market participant needs to observe all regulatory requirements. One of the reasons behind that was and is the customer protection and equal treatment of companies. BaFin cites the fact that the sandbox model promotes conflicts of interest as the main reason for this:[1] after all, how would a supervisor behave if a FinTech, which BaFin had previously taken care of in its sandbox, did not treat his customers the way it should?[2]

Upshot

Regulatory sandboxes offer interested companies a good opportunity to test the products they develop under real regulatory conditions and in a supervisory environment specially tailored to innovative companies and therefore to better understand all (regulatory) possibilities and risks on the innovative product. It should be emphasized though that regulatory sandboxes do not apply a supervision light; rather all regulatory requirements must be fulfilled, especially with regard to a required authorisation. However, precise testing under real regulatory conditions and close monitoring by the supervisory authority can provide companies with important insights into their innovative products.


[1] New Year’s press reception of BaFin 2016, Speech by Felix Hufeld, President of BaFin, in Frankfurt am Main on 12 January 2016, available at https://www.bafin.de/SharedDocs/Veroeffentlichungen/DE/Reden/re_160112_neujahrspresseempfang_p.html (accessed on 22 January 2019).

[2] New Year’s press reception of BaFin 2016, Speech by Felix Hufeld, President of BaFin, in Frankfurt am Main on 12 January 2016, available at https://www.bafin.de/SharedDocs/Veroeffentlichungen/DE/Reden/re_160112_neujahrspresseempfang_p.html (accessed on 22 January 2019).

ESAs publish joint report on regulatory sandboxes and innovation hubs – Part 1: Innovation hubs available for enquiries

On January 7th 2019, the European Supervisory Authorities (ESAs) (consisting of the European Securities and Markets Authority, the European Banking Authority and the European Insurance and Occupational Pension Authority) published as part of the European´s Commission FinTech Action Plan e a joint report on innovation facilitators (i.e. regulatory sandboxes and innovation hubs) available here . The report sets out a comparative analysis of the innovation facilitators established to date within the EU including the presentation of best practices for the design and operation of innovation facilitators.

We take the report as an occasion to present both innovation hubs and regulatory sandboxes in a two-part article. In Part 1 we will discuss what exactly innovation hubs are, what goals they pursue and how they are structured in Germany. Part 2 will then deal with the regulatory sandboxes.

Innovation hubs – What they are and what their goals are

It is often difficult for companies to obtain binding statements on regulatory requirements when a business model is still developing. Innovation hubs create a formal framework that considerably simplifies the exchange between innovators and supervisors, thereby promoting market access.

Innovation hubs provide a dedicated point of contact for firms to raise enquiries with competent authorities on Fin Tech-related issues to seek non-binding guidance on the conformity of innovative financial products, financial services, business models or delivery mechanisms with licensing or registration requirements and regulatory and supervisory expectations. In general, the innovation hubs are available to companies as a user interface at the relevant national authority. In Germany, the innovation hub is located at the Federal Financial Supervisory Authority (Bundesanstalt für FinanzdienstleistungsaufsichtBaFin) and is available here. A total of twenty-one EU Member States have established innovation hubs.[1]

Innovation hubs have been set up to enhance firms´ understanding of the regulatory and supervisory expectations regarding innovative business models, products and services. To achieve this goal, firms are provided with a contact point for asking questions of, and initiate dialogue with, competent authorities regarding the application of regulatory and supervisory requirements to innovative business models, financial products, services and delivery mechanisms. For example, the innovation hubs provide firms with non-binding guidance on the conformity of their proposed business model with regulatory requirements; specifically, whether or not the proposition would include regulated activities for which authorisation is required.

Who can participate and how does an innovation hub work exactly?

In the following, we explain which companies can participate in the innovation hubs and describe how exactly the communication between the companies and the innovation hub takes place.

Scope

The innovation hubs are open to all firms, whether incumbents or new entrants, regulated or unregulated which adopt or consider to adopt innovative products, services, business models or delivery mechanisms.

Communication process between firms and competent authorities

The following ESA graph illustrates the communication process between the firms and the competent authority using the innovation hub. The individual phases of the communication process are explained below. [2]

Submission of enquiries via interface

In order to submit enquiries, all innovation hubs set up in the EU Member States offer interested companies user interfaces through which contact can be established with the respective supervisory authority. This can be done e.g. by telephone or electronically, but also via online meetings or websites. Some innovation hubs also offer the possibility of organising physical meetings. In Germany, BaFin provides an electronic contact form in which both the company data and the planned business model can be presented and transmitted to BaFin. The contact form is available here.

Assigning the request to the relevant point of contact within the competent authority

As soon as the contact has been established and the request has been submitted, typically the authority conducts a screening process to determine how best to deal with the queries raised. In this process, the authority considers factors such as the nature of the query, its urgency and its complexity, including the need to refer the query to other authorities, such as data protection authorities.

Providing responses to the firms

Depending on the nature of the enquiries raised, several information exchanges between the firm and the competent authority may take place. Responses to firms may be routed to different channels such as meetings, telephone calls or email. Typically, the responses provided via the innovation hub are to be understood as preliminary guidance based solely on the facts established in the course of the communications between the firms and the competent authority. The companies can use the information gained to better understand the regulatory requirements for their planned business model and develop it further on this basis.

Follow-up actions

Some authorities offer follow-up actions within their innovation hubs. Especially if the communication process between the company and the authority shows that the business model of the company includes a regulated activity. In this case, some competent authorities may provide support within the authorisation process (e.g. dedicated point of contact, guidance on the completion of the application form).

Previous experiences on the use of innovation hubs

Although innovation hubs are available to all market participants, according to the ESA report, three categories of companies in particular use the innovation hubs: (i) start-ups, (ii) regulated entities that are already supervised by competent authorities and are considering innovation products or services and (iii) technology providers offering technical solutions to institutions active in the financial markets.

Typically, the firms use the innovation hub to seek information about the following: (i) whether or not a certain activity needs authorisation and, if so, information about the licensing process and the regulatory and supervisory obligations, (ii) whether or not anti-money laundering issues arise, and (iii) the applicability of consumer protection regulation and (iv) the application of regulatory and supervisory requirements (e.g. systems and controls).

Upshot

Innovation hubs provide companies with a good opportunity to interact with regulators via a user-friendly platform. They can therefore clarify the regulatory requirements for the products they plan to develop at an early stage and incorporate them into their business planning. By setting up innovation hubs, especially for young and dynamic (FinTech-) start-ups, the inhibition threshold to contact the supervisory authority is significantly lowered, especially because predefined user interfaces can be used.


[1] Austria, Belgium, Bulgaria, Cyprus, Germany, Denmark, Estonia, Spain, Finland, France, Hungary, Ireland, Iceland, Italy, Liechtenstein, Lithuania, Luxembourg, Latvia, Netherlands, Norway, Poland, Portugal, Romania, Sweden, UK.

[2] Source: ESA Report FinTech: Regulatory sandboxes and innovation hubs.

Germany is paving the way for an informal transition period for the financial market in case of hard Brexit

On 20 November 2018, the Federal Ministry of Finance of Germany published a Draft Act on Tax-Related Provisions concerning the withdrawal of the United Kingdom of Great Britain and Northern Ireland from the European Union.

The Draft Act proposes amendments to the German Banking Act (Kreditwesengesetz) and the Insurance Supervision Act (Versicherungsaufsichtsgesetz) and aims to avoid any harm to the functioning or stability of financial markets in case of a hard Brexit, i.e., the withdrawal of the UK from the EU by the end of March 2019 without an agreement.

BaFin will be allowed to grant a transition period until the end of 2020 for passporting financial services into Germany

The proposed amendment to the KWG will allow the German Federal Financial Supervisory Authority (BaFin) to permit firms based in the UK, which have been providing cross-border banking or financial services based on a European passport before Brexit, to continue to operate financial transactions in Germany until the end of 2020 at the latest. The proposal reads:

In the event that the United Kingdom of Great Britain and Northern Ireland withdraws from the European Union at midnight on 29 March 2019 without having concluded an agreement on withdrawal from the European Union […] the Supervisory Authority may determine, in order to prevent disadvantages for the capacity of financial markets to function or for their stability, that the [passporting] provisions […] are to be applied accordingly, fully or partially, for a period of up to 21 months following the time of withdrawal, to companies based in the United Kingdom of Great Britain and Northern Ireland that on 29 March 2019 conduct banking business or provide financial services in Germany through a branch in Germany or by providing cross-border services [under the passporting regime]. [This] only applies to financial transactions that are completed after 29 March 2019 insofar as these transactions are closely connected to transactions that existed at the time of withdrawal.

As already mentioned here the FCA has been planning to take similar precautions for a hard Brexit. Now Germany is following.

The Draft Act, which needs to go through parliament before entering into force, authorises BaFin to extend the current passporting regime at its own discretion. BaFin may adopt a generally applicable rule for all institutions concerned or restrict it to individual supervisory areas that are highly affected. The transition period can also be shortened by BaFin. In addition, BaFin may attach conditions to its permission regime and abolish its measures at any time.

According to the currently proposed wording of the Draft Act, the transition period only applies to financial transactions concluded before Brexit. New financial transactions are only included if they are closely related to existing ones.

During the transition period, the companies concerned must prepare themselves to either apply for a respective license in Germany in order to to submit their German business to the supervisory regime for third countries, or to bring their German business to an end.

Transition period also proposed for the insurance sector

The Draft Act authorises BaFin to adopt a similar transition period for insurance undertakings in order to avoid disadvantages for policyholders and beneficiaries. This will enable insurance companies based in the UK to either transfer or terminate existing contracts within a reasonable timeframe, or meet the necessary prudential requirements for an orderly run-off of such contracts, where this is not possible.

Draft Act subject to European law

In case the EU comes up with a similar and uniform transition rule to protect the financial markets from any chaotic disruption due to Brexit, the EU rule will prevail.

Who is Who? European Supervisory Authorities – How they Cooperate and Interact

If you are looking for guidance from national and European supervisory authorities, it is not easy to see at first glance how they work together and whose guidance is most relevant. We want to shed some light on the ‘Who is Who?’ of German and European regulators.

Financial market supervision in Germany

The first go-to regulator in Germany is the Federal Financial Supervisory Authority (BaFin), which is entrusted with the tasks of banking, insurance and securities supervision and acts as a universal financial supervisory authority. BaFin is also responsible for ensuring that financial services, banking and insurance transactions are not conducted without a license and can also sanction any violations against the regulatory regime – and does so regularly. One of the newest additions to the list of tasks of BaFin is supervising compliance with consumer protection rules within the financial market. This primarily concerns cases in which regulated institutions violate regulatory provisions that protect consumers. If these infringements go beyond individual cases, they are pursued in the public interest by BaFin. BaFin, together with criminal enforcement authorities, is also responsible for pursuing money laundering and terrorist financing and supervising compliance with AML requirements. BaFin’s banking and insurance supervisory office is based in Bonn, the office responsible for securities supervision, asset management and bank resolution is based in Frankfurt am Main.

In Germany, the task of banking supervision is shared by BaFin and the German Central Bank (Deutsche Bundesbank). BaFin and Deutsche Bundesbank, e.g., oversee whether the banks have sufficient financial resources and whether business operations are properly organised. BaFin and Bundesbank receive the necessary information from the banks themselves or obtain it through on-site audits. The Bundesbank is responsible for the majority of operational banking supervision, namely the reporting and evaluation of audit reports submitted by the institutions and the performance of special audits. Guidelines for ongoing supervision and interpretation of legal requirements are mainly issued by BaFin.

The supervision of insurance policies by BaFin is intended to ensure that the insurance companies are capable of providing the benefits to which they are obliged. To this end, BaFin checks, for e.g., whether the insurance companies have sufficient financial resources and assess risks correctly.

BaFin’s supervision of securities serves the purpose of ensuring the availability of sufficient information and transparency for all market participants by monitoring the proper publication of relevant information. BaFin also monitors insider trading and price manipulation.

European financial market supervisory regime

BaFin and Deutsche Bundesbank are not the only regulators you have to keep up with when you are a regulated institution. At the European level, the European Securities and Markets Authority (ESMA), the European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA) have their say and the European Central Bank (ECB) is also responsible for financial market supervision within the Eurozone.

The Single Supervisory Mechanism (SSM) has entrusted the ECB with the direct supervision of significant financial institutions in the Eurozone. These are about 120 banks and banking groups. To fall within the ECB’s responsibility, a bank must either have a balance sheet total of more than €30 billion or more than 20% of its home country’s GDP. If these thresholds are not met, the ECB monitors the 3 largest banks in each of the countries participating in the SSM (which are 19 countries in the Eurozone). All other banks will continue to be supervised by the national supervisory authorities.

If the ECB is in charge, the ECB cooperates with the national supervisory authorities of the banks’ home countries. Joint Supervisory Teams (JSTs) are set up by the ECB for coordination. These are composed of staff from the ECB and the national supervisory authorities. In Germany JSTs consist of members of the ECB, BaFin and Deutsche Bundesbank. A consistent supervisory practice can be established through the JSTs, taking into account national standards and a uniform standard within the Eurozone.

In contrast to the day-to-day supervision of the national regulators and the ECB, the European supervisory authorities EBA, ESMA and EIOPA (together ESAs) generally do not act directly vis-à-vis individual financial institutions, but ensure uniform standards within the EU. They also monitor the application of EU law by national supervisory authorities and the market. For this purpose, they use convergence instruments such as guidelines and Q&As (Questions and Answers), which aim at a consistent application of EU law by the national supervisory authorities. In practice, however, European directives are not always implemented equally in each Member State since the directives also leave a scope of interpretation for the national legislator on certain aspects of regulatory law.

The guidelines issued by EBA, ESMA and EIOPA are binding for the national regulators in Europe. They are not directly binding for the institutions but become directly binding when adopted by the national regulators. BaFin publishes on its homepage whenever it adopts guidelines, and also when guidelines are specifically not integrated within the German administrative practice. The advantage of the ESA’s approach of having a single rulebook and consistent rules throughout the EU for the market is that the provision of cross-border services becomes easier if just one set of rules apply.

EBA, ESMA and EIOPA are also actively involved in the European legislative process by supporting the European Commission in drafting legislative proposals based on their knowledge of the European financial market and its supervisory mechanisms.

Although the ESAs do not act directly vis-à-vis the majority of the regulated institutions, it is worth monitoring their publications to get an early grip on regulatory developments. The European administrative practice is essentially formed through the ESAs. It is also worth noting that the ESAs usually publish drafts of their envisaged guidelines for consultation purposes. For lobbying purposes it is essential to participate in such consultations.