Special organisational duties; provisions for risk takers; power to issue a statutory instrument

(1) An institution must have a proper business organisation that ensures compliance with the statutory provisions to be observed by the institution and with business management requirements. The managers are responsible for the institution's proper business organisation; they must take the measures necessary to draw up the corresponding internal institutional requirements, unless the administrative or supervisory body decides. This includes, in particular, effective procedures for identifying, managing, monitoring, and reporting the risks to which the institution is, or could be, exposed, including short-, medium-, and long-term environmental, social, and governance risks, and the concentration risk arising from risk positions vis-à-vis central counterparties, taking into account the conditions laid down in Article 7a of Regulation (EU) No 648/2012. A proper business organisation must in particular include sound corporate governance and adequate and effective risk management, on the basis of which an institution must continuously ensure its risk-bearing capacity; risk management includes in particular 1. determining strategies, in particular determining a business strategy directed at the institution's sustainable development and a risk strategy consistent with it, and establishing processes for planning, implementing, assessing, and adapting the strategies, whereby the strategies and the processes established for them must be reviewed, and adapted where necessary, every two years by small and non-complex institutions within the meaning of Article 4(1), first subparagraph, point 145, of Regulation (EU) No 575/2013, and regularly, but at least every two years, by other institutions, depending on the type, scale, complexity, and risk content of their business activities; 2. procedures for determining and ensuring risk-bearing capacity, based on a prudent determination of the risks, of the potential losses arising from stress scenarios, including those determined under the supervisory stress test under section 6b(3), and of the risk coverage potential available to cover them; 3. establishing internal control procedures, with an internal control system and an independent internal audit function, whereby the internal control system in particular comprises: a) organisational and operational rules with a clear delineation of areas of responsibility, b) processes for identifying, assessing, managing, and monitoring and communicating risks in accordance with the criteria set out in Title VII, Chapter 2, Section 2, Subsection II, of Directive 2013/36/EU as amended on 27 November 2024, and c) an independent risk control function and an independent compliance function; the internal audit function may not be combined with other business areas or control functions of the institution; 4. adequate staffing and technical-organisational resources for the institution; 4a. adequate capacities for data management and effective processes to ensure data quality; 5. establishing adequate contingency management, in particular for IT systems, and 6. adequate, transparent remuneration systems for managers and employees directed at the institution's sustainable development, taking subsection (5) into account; this does not apply, except for the duty to disclose remuneration-related information, insofar as the remuneration is agreed by collective bargaining agreement, or, within its scope, by agreement of the parties to the employment contract on the application of the collective-bargaining provisions, or on the basis of a collective bargaining agreement in a works agreement or service agreement. The design of risk management depends on the type, scale, complexity, and risk content of the business activities. Its adequacy and effectiveness must be reviewed regularly by the institution. A proper business organisation further includes 1. adequate arrangements enabling the institution's financial position to be determined, at any time, with sufficient accuracy; 2. complete documentation of the business activity that ensures seamless monitoring by the Federal Institute within its area of responsibility; the necessary records must be kept for at least five years; section 257(4) of the Commercial Code remains unaffected, and section 257(3) and (5) of the Commercial Code applies correspondingly, and 3. a process enabling employees, while preserving the confidentiality of their identity, to report to appropriate bodies within the undertaking breaches of Regulation (EU) No 575/2013, Regulation (EU) No 596/2014 of the European Parliament and of the Council of 16 April 2014 on market abuse (Market Abuse Regulation) and repealing Directive 2003/6/EC of the European Parliament and of the Council and Commission Directives 2003/124/EC, 2003/125/EC and 2004/72/EC (OJ L 173, 12.6.2014, p. 1; L 287, 21.10.2016, p. 320; L 306, 15.11.2016, p. 43; L 348, 21.12.2016, p. 83), as last amended by Regulation (EU) 2016/1033 (OJ L 175, 30.6.2016, p. 1), Regulation (EU) No 600/2014, Regulation (EU) No 1286/2014, or Regulation (EU) 2017/1129 of the European Parliament and of the Council of 14 June 2017 on the prospectus to be published when securities are offered to the public or admitted to trading on a regulated market, and repealing Directive 2003/71/EC (OJ L 168, 30.6.2017, p. 12), or breaches of this Act or of the statutory instruments issued under this Act, or of the Securities Trading Act or of the statutory instruments issued under the Securities Trading Act, and any criminal acts within the undertaking.
(2) The Federal Institute may order an institution to apply the standardised approach or the simplified standardised approach, in each case under Delegated Regulation (EU) 2024/857 as amended on 1 December 2023, for the management of interest rate risk arising from business not held in the trading book, where the internal procedures and methods do not ensure adequate and effective risk management in this area. The Federal Institute may, in the individual case, issue orders to an institution that are suitable and necessary to ensure the proper business organisation within the meaning of subsection (1), third and sixth sentences.
(3) Subsections (1) and (2) apply correspondingly to institutional groups, financial holding groups, and mixed financial holding groups, as well as sub-consolidation groups under Article 22 of Regulation (EU) No 575/2013, on the basis that the managers of the parent undertaking, or of the undertaking obliged to sub-consolidate, are responsible for the proper business organisation, including sound corporate governance and adequate and effective risk management, of the institutional group, financial holding group, mixed financial holding group, or sub-consolidation group. A group within the meaning of the first sentence also includes subsidiary undertakings of a parent undertaking or of a subordinate subsidiary undertaking of an institutional group, financial holding group, or mixed financial holding group, to which neither Regulation (EU) No 575/2013 nor section 1a applies. The rules, procedures, and mechanisms of the undertakings belonging to the group must, in doing so, be coherent and mesh with one another. The duties arising from the first and third sentences need be observed by subsidiary undertakings of the group with their registered office in a third country only insofar as these duties do not conflict with the law applicable in the subsidiary undertaking's home state.
(4) The Federal Ministry of Finance is empowered, in agreement with the Deutsche Bundesbank and after consulting the European Central Bank, to issue a statutory instrument, not requiring the consent of the Bundesrat, setting out further provisions on the design of adequate and effective risk management at the level of the individual institution and the group under subsection (1), third sentence, points 1 to 5, and subsection (3), and of the associated activities and processes in each case. The institutions' umbrella associations must be heard before the statutory instrument is issued.
(5) Institutions must determine appropriate ratios between variable and fixed annual remuneration for employees and managers. Subject to a resolution under the fifth sentence, they must keep the variable remuneration, in each case, at a maximum of 100 percent of the fixed remuneration for each individual employee or manager. For up to 25 percent of the variable remuneration, the future value may be discounted to the point in time of the communication to the respective employees or managers of the amount of variable remuneration for an assessment period, where this part of the variable remuneration is paid in instruments that are retained for a period of at least five years after this communication. During the retention, a claim and an expectancy to this part of the variable remuneration may arise only after the retention period has ended, and during the retention period there may exist only a claim to the error-free determination of the part of this part of the variable remuneration that has not yet matured into an expectancy or a claim, but not a claim to this part of the variable remuneration itself. The shareholders, owners, members, or sponsoring bodies of the institution may resolve to approve a higher variable remuneration than under the second sentence, which may not exceed 200 percent of the fixed remuneration for each individual employee or manager. For approval of a higher variable remuneration than under the second sentence for employees, the management and the administrative or supervisory body must make a proposal for a resolution; for approval of a higher variable remuneration than under the second sentence for managers, only the administrative or supervisory body must make such a proposal; the proposal must set out the reasons for the requested approval of a higher variable remuneration than under the second sentence and its extent, including the number of employees and managers affected and their functions, and the expected effect of a higher variable remuneration than under the second sentence on the requirement to maintain adequate own funds. The proposed resolution must be published sufficiently in advance of the resolution being passed that the shareholders, owners, members, or sponsoring bodies of the institution can inform themselves appropriately; where the shareholders, owners, members, or sponsoring bodies exercise their rights at a meeting, the proposed resolution must be published together with the notice convening the meeting. The resolution requires a majority of at least 66 percent of the votes cast, provided at least 50 percent of the voting rights are represented when the resolution is passed, or a majority of at least 75 percent of the votes cast. Shareholders, owners, members, or sponsoring bodies who would be affected, as employees or managers, by a higher variable remuneration than under the second sentence, may not exercise their voting rights, whether directly or indirectly.
(5a) For risk takers of significant institutions whose annual fixed remuneration exceeds three times the contribution assessment ceiling in the general statutory pension insurance scheme within the meaning of section 159 of Book Six of the Social Code, and who are not managing directors, works managers, or similar senior employees authorised to hire or dismiss employees independently, section 9(1), second sentence, of the Dismissal Protection Act applies on the basis that the employer's application for the termination of the employment relationship does not require a statement of reasons. Section 14(1) of the Dismissal Protection Act remains unaffected.
(5b) In a CRR credit institution, and in an institution that is not a CRR credit institution but is significant under section 1(3c), the following groups of persons are mandatorily deemed risk takers: 1. employees of the management level immediately below the management body; 2. employees with management responsibility for the control functions or the material business areas of the institution; 3. employees who, in or for the preceding financial year, were entitled to remuneration of at least EUR 500,000, provided that a) this remuneration is at least equal to the average remuneration of the managers, the members of the administrative or supervisory body, and the employees of the management level immediately below the management body within the meaning of point 1, and b) the employees carry out their professional activity in a material business area and this activity has a material effect on the risk profile of the business area concerned. A significant institution must, further, determine on its own responsibility, on the basis of a risk analysis, all other risk takers. At least the criteria under Articles 5 and 6 of Delegated Regulation (EU) 2021/923 as amended on 25 March 2021 must always be applied as a basis. The institution must notify the employees concerned of their classification as risk takers without delay. The risk analysis must be documented in writing or electronically and updated regularly. Exceptions under Article 6(2) of Delegated Regulation (EU) 2021/923 as amended on 25 March 2021 require the consent of the management and prior notice to the administrative or supervisory body. For the purposes of this provision, the definitions and the calculation methods for the amount of the relevant remuneration under Delegated Regulation (EU) 2021/923 as amended on 25 March 2021 apply.
(5c) Applications to be made to the supervisory authority under Article 6(3), first sentence, of Delegated Regulation (EU) 2021/923 as amended on 25 March 2021 must be made without delay, but no later than six months after the end of the financial year.
(6) The Federal Ministry of Finance is empowered, in consultation with the Deutsche Bundesbank, to issue a statutory instrument, not requiring the consent of the Bundesrat, setting out further provisions on: 1. the design of the remuneration systems under subsection (1), third sentence, point 6, including the design of a) the decision-making processes and responsibilities, b) the ratio of variable to fixed remuneration and the remuneration instruments for variable remuneration, c) positive and negative remuneration parameters, performance periods, retention periods, and clawback periods, including the conditions and parameters for a complete loss, a partial reduction, or a complete or partial clawback of variable remuneration, and the consideration of the institution-specific and group-wide business and remuneration strategy, including its application and implementation in undertakings to be consolidated, or voluntarily consolidated, under Article 18 of Regulation (EU) No 575/2013, of the objectives, values, and long-term interests of the institution, 2. the conditions and the procedure for approving a higher ratio between variable and fixed annual remuneration under subsection (5), second to ninth sentences, 2a. the calculation of the ratio of variable to fixed remuneration under subsection (5), second to fifth sentences, in particular the discount factors for determining the present value of variable remuneration to be applied as a basis, 3. the institution's monitoring of the adequacy and transparency of the remuneration systems and the further development of the remuneration systems, including the involvement of the remuneration control committee and a remuneration officer, 4. the disclosure of the design of the remuneration systems and the composition of remuneration, including the total amount of guaranteed bonus payments and individually contracted severance payments, stating the highest severance payment made and the number of beneficiaries, insofar as not covered by Article 450 of Regulation (EU) No 575/2013, the medium of disclosure, and the frequency of disclosure, 5. the design of disclosure under Article 450 of Regulation (EU) No 575/2013, and 6. the complete or partial exclusion of institutions that are not CRR institutions from the scope of the statutory instrument. The rules must in particular be geared to the size and remuneration structure of the institution, and to the type, scale, complexity, risk content, and international scope of the business activities. In the context of the provisions under the first sentence, point 4, the provisions of commercial law relating to the disclosure of remuneration under section 340a(1) and (2) in conjunction with section 340l(1), first sentence, of the Commercial Code must remain unaffected. The Federal Ministry of Finance may transfer this power, by statutory instrument, to the Federal Institute, on condition that the statutory instrument is issued in agreement with the Deutsche Bundesbank. The institutions' umbrella associations must be heard before the statutory instrument is issued.