(1) As part of the audit of the annual financial statements and of any interim financial statements, the auditor must also audit the institution's financial position. In auditing the annual financial statements, the auditor must in particular determine whether the institution has fulfilled the following notification duties and requirements:
1. the notification duties under sections 11, 12a, 14(1), and under Regulation (EU) No 575/2013 as amended from time to time, under sections 15, 24, and 24a, in each case also in conjunction with a statutory instrument under section 24(4), first sentence, and under section 24a also in conjunction with a statutory instrument under section 24a(5), and
2. the requirements
a) under section 3(2) and (3), under sections 10a, 10c to 10j, in each case also in conjunction with a statutory instrument under section 10(1), first sentence, point 5, under sections 11, 13 to 13c, 18, 18a, 25(1) and (2), section 25a(1), third sentence, in each case also in conjunction with a statutory instrument under section 25(3), and section 25a(5) also in conjunction with a statutory instrument under section 25a(6), under section 25a(1), sixth sentence, point 1, and (3), under sections 25b, 25c(2) to (4b), section 25d(3) to (12), under sections 26a and 26b, under section 13, under sections 26c and 26d, under section 51a(1) also in conjunction with a statutory instrument under section 51a(1), under section 51b(1) also in conjunction with a statutory instrument under section 51b(2), and under section 51c(1),
b) under sections 17, 20, 23, 25, and 27 of the Financial Conglomerates Supervision Act,
c) under Article 4(1), (2), (3), second subparagraph, and (3a), under Articles 4a and 7a(1) to (5), under Article 7b(1) and (2), under Article 7c(1) to (3), under Article 7d(1), under Article 9(1) to (3), and Article 11(1) to (11), first subparagraph, and (12) of Regulation (EU) No 648/2012,
d) under Articles 92 to 386 of Regulation (EU) No 575/2013, also in conjunction with a statutory instrument under section 10(1), first sentence, under Articles 387 to 403 and 411 to 430b of Regulation (EU) No 575/2013, also in conjunction with a statutory instrument under section 13(1), first sentence,
e) under Article 4(1), first subparagraph, Article 5a(1), and under Articles 8b to 8d of Regulation (EC) No 1060/2009 as amended from time to time, insofar as it is not audited under section 29(2) in conjunction with section 89(1), first sentence, of the Securities Trading Act,
f) under Article 9 of Regulation (EU) No 909/2014, and the regulatory and implementing technical standards based on it adopted by the European Commission,
g) under Article 4(1) to (5) and Article 15 of Regulation (EU) 2015/2365 of the European Parliament and of the Council of 25 November 2015 on transparency of securities financing transactions and of reuse and amending Regulation (EU) No 648/2012 (OJ L 337, 23.12.2015, p. 1),
h) under Articles 16, 23(3), first sentence, and (5), (6), and (10), under Article 28(2), and under Article 29 of Regulation (EU) 2016/1011 of the European Parliament and of the Council of 8 June 2016 on indices used as benchmarks in financial instruments and financial contracts or to measure the performance of investment funds and amending Directives 2008/48/EC and 2014/17/EU and Regulation (EU) No 596/2014 (OJ L 171, 29.6.2016, p. 1),
i) under Article 28(1) to (3) of Regulation (EU) No 600/2014,
j) under Articles 5 to 9, 18 to 26, 26b to 26e, 27(1) and (4), and under Article 43(5) and (6) of Regulation (EU) 2017/2402,
k) under section 5(1) and (2) and sections 7 to 14 and 16 to 22 of the Electronic Securities Act, also in conjunction with a statutory instrument under section 15 or section 23 of the Electronic Securities Act, and
l) under Articles 3 to 11 of Regulation (EU) 2022/858 of the European Parliament and of the Council of 30 May 2022 on a pilot regime for market infrastructures based on distributed ledger technology, and amending Regulations (EU) No 600/2014 and (EU) No 909/2014 and Directive 2014/65/EU (OJ L 151, 2.6.2022, p. 1), insofar as the business affected by it is provided by the institution, and
m) under Articles 5 to 14, 16 to 19, 23 to 25, 28 to 30, and 45(3) of Regulation (EU) 2022/2554, also in conjunction with a Delegated Regulation under Articles 15, 16, 20, 28, or Article 30 of Regulation (EU) 2022/2554. Where an institution is exempted under section 2a(1), the auditor must examine whether the conditions named in Article 7 of Regulation (EU) No 575/2013, as amended from time to time, continue to be met. Where an institution is exempted under section 2a(3), the auditor must examine whether the conditions named in Article 8 of Regulation (EU) No 575/2013, as amended from time to time, continue to be met. Where the Federal Institute has made provisions on the content of the audit vis-à-vis the institution under section 30, these must be taken into account by the auditor. Insofar as unrealised reserves are attributed to the institution's liable capital, the auditor must, when auditing the annual financial statements, also examine whether section 10(4a) to (4c), in the version applicable until 31 December 2013, was observed in determining these reserves. For a credit institution that has been requested to draw up a recovery plan under section 12 of the Recovery and Resolution Act, the auditor must also examine whether the recovery plan meets the conditions under section 12(1) and section 13(1) to (4) of the Recovery and Resolution Act. The result must be included in the audit report.
(1a) Subsection (1) applies, in relation to the requirements under Article 4(1), (2), (3), second subparagraph, and (3a), under Articles 4a and 7a(1) to (5), under Article 7b(1) and (2), under Article 7c(1) to (3), under Article 7d(1), under Article 9(1) to (3), and Article 11(1) to (11), first subparagraph, and (12) of Regulation (EU) No 648/2012, to the audit of the annual financial statements of central counterparties, on the basis that the auditor must additionally examine whether the requirements under Article 7(1) to (4), Articles 7e, 8(1) to (4), Articles 26, 29, and 33 to 54 of Regulation (EU) No 648/2012, and under Article 29(2), Articles 30 and 35 of Regulation (EU) No 600/2014, and the regulatory technical standards adopted under these Articles, are complied with. The first sentence applies correspondingly to the abridged financial statements of a central counterparty, where such financial statements must be drawn up under the statutory requirements.
(1b) In auditing the annual financial statements of a central securities depository, it must also be examined whether the requirements under Articles 6, 7, 26 to 53, 54(3), and under Article 59 of Regulation (EU) No 909/2014, and the regulatory and implementing technical standards adopted by the European Commission under these Articles, are complied with. In auditing the annual financial statements of a credit institution designated by a central securities depository under Article 54(4) of Regulation (EU) No 909/2014 to provide banking-type ancillary services, it must, further, be examined whether the requirements under Article 54(4) and Article 59 of Regulation (EU) No 909/2014, and the regulatory and implementing technical standards adopted by the European Commission under these Articles, are complied with. The first and second sentences apply correspondingly to the abridged financial statements of a central securities depository, where such financial statements must be drawn up under the statutory requirements.
(2) The auditor must also examine whether the institution has fulfilled its obligations under sections 24c and 25g(1) and (2), sections 25h to 25m, and the Anti-Money Laundering Act; for credit institutions, the auditor must also examine whether the credit institution has fulfilled its obligations under Regulation (EU) 2021/1230, Regulation (EU) No 260/2012, Regulation (EU) 2023/1113, Regulation (EU) 2015/751, the Payment Accounts Act, and sections 45, 46, and 48 to 55 of the Payment Services Supervision Act. In addition, the auditor must examine compliance with the notification and publication duties and other requirements of Articles 5 to 10 and 12 to 14 of Regulation (EU) No 236/2012 of the European Parliament and of the Council of 14 March 2012 on short selling and certain aspects of credit default swaps (OJ L 86, 24.3.2012, p. 1). For institutions, branches within the meaning of section 53b, and branches within the meaning of section 53 that conduct safe custody business, or, as custodian within the meaning of the Capital Investment Code, safe custody business together with crypto securities register maintenance, the auditor must examine this business specially, insofar as it is not to be audited under section 89(1), second sentence, of the Securities Trading Act; this examination must also extend to compliance with section 67a(3) and section 67b, in each case also in conjunction with section 125(1), (2), and (5) of the Stock Corporation Act, on notification duties, and section 135 of the Stock Corporation Act, on the exercise of voting rights. For central securities depositories, it must also be examined specially whether the provisions of the Safe Custody Act, of sections 7 to 10 and 12 and 13 of the Electronic Securities Act, also in conjunction with a statutory instrument under section 15 of the Electronic Securities Act, and of section 67a(3), section 67b, in each case also in conjunction with section 125(1), (2), and (5), and section 135 of the Stock Corporation Act, are complied with. For Pfandbrief banks within the meaning of section 1(1), first sentence, of the Pfandbrief Act, compliance with the organisational requirements for the procedures and systems under section 4(4), and sections 4b, 5, 16, 24, 26d, 27, 27a, and 28 of the Pfandbrief Act must be examined. A separate report must be made on each of the examinations under the first to fifth sentences; section 26(1), third sentence, applies correspondingly.
(3) The auditor must notify the Federal Institute and the Deutsche Bundesbank without delay where facts become known to it during the audit that justify a qualification or refusal of the auditor's certificate, that could endanger the institution's continued existence or materially impair its development, that constitute a material breach of the provisions on the institution's licensing conditions or on the pursuit of an activity under this Act, or that reveal serious breaches by the managers of statute, the institution's statutes, or its articles of association. On the request of the Federal Institute or the Deutsche Bundesbank, the auditor must set out to them the type and scope of its procedure, explain the audit report, and communicate other facts that became known during the audit and that indicate against the proper conduct of the institution's business. The duties to notify, explain, and communicate under the first and second sentences also exist in relation to an undertaking that has close links with the institution, provided the facts become known to the auditor in the course of auditing the institution. The auditor is not liable for the correctness of facts that it notifies in good faith under this subsection.
(4) The Federal Ministry of Finance is empowered, in agreement with the Federal Ministry of Justice and Consumer Protection and after consulting the Deutsche Bundesbank, to issue a statutory instrument setting out further provisions on
1. the subject matter of the audit under subsections (1) to (2),
2. the timing of its conduct, and
3. the content and form of the audit reports, insofar as this is necessary for the Federal Institute to perform its tasks, in particular in order to recognise deficiencies that could endanger the safety of the assets entrusted to an institution or impair the proper conduct of banking business or financial services, and to obtain uniform documents for assessing the business conducted by institutions. The statutory instrument may provide that the duties governed by subsections (1) to (3) must also be observed when auditing the consolidated financial statements of an institutional group, a financial holding group, or a mixed financial holding group, or of a financial conglomerate; further provisions on the subject matter of the audit, the timing of its conduct, and the content of the audit report may be issued in this regard in accordance with the first sentence. The Federal Ministry of Finance may transfer this power, by statutory instrument, to the Federal Institute.