Provisions on regulatory fines

(1) It is a regulatory offence for a person, intentionally or negligently, to 1. include information in a qualified certificate contrary to section 12(1) sentence 2, 3 or 4, or subsection (2), each also in conjunction with subsection (3) sentence 1 or a statutory ordinance under section 20(2) number 1, 2. fail to revoke a certificate, or fail to do so in time, contrary to section 14(1) sentence 1 numbers 1 to 4 or section 16(1) sentence 2, 3. fail to ensure that a record is transmitted, contrary to section 16(1) sentence 3, also in conjunction with the statutory ordinance under section 20(2) number 1, or 4. fail to take an arrangement referred to there, or fail to do so in time, contrary to section 16(2) in conjunction with the statutory ordinance under section 20(2) number 1.
(2) It is a regulatory offence for a person to infringe Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC (OJ L 257, 28.8.2014, p. 73; L 23, 29.1.2015, p. 19), by, intentionally or negligently, 1. failing to make a notification, or failing to make it correctly or in time, contrary to Article 19(2) subparagraph 1, 2. failing to inform a person, or failing to do so correctly or in time, contrary to Article 19(2) subparagraph 2, 3. failing to submit a communication, or failing to do so correctly or in time, contrary to Article 21(1), 4. failing to verify a person's identity, or failing to do so in time, contrary to Article 24(1) subparagraph 1, 5. failing to take out liability insurance, or failing to do so in time, contrary to Article 24(2)(c) in conjunction with section 10 in conjunction with a statutory ordinance under section 20(2) number 3, 6. failing to use a trustworthy system or product, contrary to Article 24(2)(e) or (f), each in conjunction with a statutory ordinance under section 20(2) number 1, 7. failing to take a measure referred to there, or failing to do so in time, contrary to Article 24(2)(g) in conjunction with a statutory ordinance under section 20(2) number 1, 8. failing to record information correctly, contrary to Article 24(2)(h) sentence 1, or 9. failing to publish a revocation, or failing to do so in time, contrary to Article 24(3) sentence 1.
(3) In the cases under subsection (2) numbers 5 to 8, the regulatory offence may be punished with a fine of up to one hundred thousand euro; in the remaining cases, with a fine of up to twenty thousand euro.
(4) The administrative authorities within the meaning of section 36(1) number 1 of the Act on Regulatory Offences are the Bundesnetzagentur and the Federal Office for Information Security, each within its area of responsibility under section 2(1).