Organisational obligations; authorisation to issue statutory instruments

(1) An investment services undertaking must comply with the organisational obligations under section 25a(1) and section 25e(4) of the Banking Act or, where it is a securities institution, under section 28(1) and (2) and section 41 of the Securities Institutions Act. In addition it must
1. take appropriate arrangements to ensure the continuity and regularity of investment services and ancillary investment services; for this purpose it must make use of suitable and proportionate systems, including the information and communication technology (ICT) systems established and managed under Article 7 of Regulation (EU) 2022/2554, and of suitable and proportionate resources and procedures;
2. maintain, on a continuing basis, effective arrangements for appropriate measures to identify and prevent, or manage, conflicts of interest in the provision of investment services and ancillary investment services, or a combination thereof, between itself, including its management, its staff, its tied agents and the persons and undertakings connected with it directly or indirectly through control within the meaning of Article 4(1), no. 37 of Regulation (EU) No 575/2013, on the one hand, and its clients, or between its clients, on the other; this also covers conflicts of interest caused by the acceptance of inducements from third parties and by the investment services undertaking's own remuneration structure or other incentive structures;
3. within the arrangements under number 2, design, implement and monitor policies or objectives relating directly or indirectly to the turnover, volume or income of transactions recommended in the course of investment advice (sales targets), in such a way that client interests are not impaired;
4. have sound security mechanisms to satisfy the requirements of Regulation (EU) 2022/2554, that ensure the security and authentication of the means of information transfer, minimise the risk of data corruption and unauthorised access, and prevent information leakage, so that the confidentiality of data is ensured at all times. Further particulars on the organisation of investment services undertakings are set out in Chapter II, Section 1 of Delegated Regulation (EU) 2017/565.
(2) An investment services undertaking must additionally comply with the provisions set out in this subsection where it trades in financial instruments in such a way that a computer algorithm automatically determines individual order parameters, other than a system used only for routing orders to one or more trading venues, for processing orders that does not involve determining order parameters, for confirming orders, or for the post-trade processing of executed orders (algorithmic trading). Order parameters within the meaning of the first sentence are in particular decisions as to whether the order should be initiated, about the timing, price or quantity of the order, or how the order is managed after its submission with limited or no human intervention. An investment services undertaking that engages in algorithmic trading must have systems and risk controls that ensure that
1. its trading systems are resilient in accordance with the requirements of Chapter II of Regulation (EU) 2022/2554, have sufficient capacity, and are subject to appropriate trading thresholds and limits;
2. the transmission of erroneous orders is avoided, or system functioning that could cause or contribute to market disruption;
3. its trading systems cannot be used for any purpose contrary to European and national rules against market abuse or to the rules of the trading venue to which it is connected. An investment services undertaking that engages in algorithmic trading must also have effective business continuity arrangements, including the ICT business continuity policy and plans and the ICT response and recovery plans drawn up under Article 11 of Regulation (EU) 2022/2554, to deal with any disruptions to its trading systems, and must ensure that its systems are fully tested and properly monitored, so that the general requirements set out in this subsection and the specific requirements set out in Chapters II and IV of Regulation (EU) 2022/2554 are satisfied. The investment services undertaking notifies the Bundesanstalt and the competent authorities of the trading venue of which it is a member or participant that it engages in algorithmic trading.
(3) An investment services undertaking that engages in algorithmic trading within the meaning of Article 18 of Delegated Regulation (EU) 2017/565 must keep sufficient records of the matters referred to in subsection (2) for at least five years. Where the investment services undertaking uses a high-frequency algorithmic trading technique, those records must in particular cover all orders placed by it, including order cancellations, executed orders and quotations at trading venues, and must be kept in chronological order. These records must be provided at the request of the Bundesanstalt.
(4) Where an investment services undertaking engages in algorithmic trading within the meaning of subsection (2) pursuing a market-making strategy, it must, having regard to the liquidity, scale and nature of the specific market and the specific characteristics of the instrument traded,
1. carry out this market making continuously during a specified proportion of the trading venue's trading hours, except in exceptional circumstances, so that the trading venue is supplied with liquidity on a regular and predictable basis,
2. enter into a written agreement with the trading venue that sets out at least the obligations under number 1, unless it is subject to the provisions of section 26c of the Stock Exchange Act, and
3. have effective systems and controls in place ensuring that it complies with those obligations at all times.
(5) An investment services undertaking that engages in algorithmic trading pursues a market-making strategy within the meaning of subsection (4) where it is a member or participant of one or more trading venues and its strategy, when dealing on own account, involves posting firm, simultaneous two-way quotes of comparable size at competitive prices relating to one or more financial instruments on a single trading venue or across different trading venues.
(6) Where an investment services undertaking outsources activities and processes as well as financial services, it must comply with the requirements of section 24(1), no. 19, including in conjunction with a statutory instrument under subsection (4), and section 25b of the Banking Act or, where it is a securities institution, sections 40 and 64(1), no. 13 of the Securities Institutions Act. The outsourcing may not alter the undertaking's legal relationships with its clients, or the obligations it owes to clients under this Part. The outsourcing may not alter the conditions under which the investment services undertaking was granted authorisation under section 32 of the Banking Act or section 15 of the Securities Institutions Act. Further particulars on the requirements applicable to outsourcing are laid down in Articles 30 to 32 of Delegated Regulation (EU) 2017/565.
(7) An investment services undertaking may provide investment advice as independent fee-based investment advice only where it provides exclusively independent fee-based investment advice, or where it separates independent fee-based investment advice from the remainder of its investment advice organisationally, functionally and in terms of personnel. Investment services undertakings must design sales targets within the meaning of subsection (1), no. 3, for independent fee-based investment advice in such a way that conflicts of interest with client interests can never arise. An investment services undertaking that provides independent fee-based investment advice must state on its website whether independent fee-based investment advice is offered at its head office and at which domestic branches it is offered.
(8) An investment services undertaking that provides financial portfolio management or independent fee-based investment advice must, through corresponding policies, ensure that all monetary inducements accepted from third parties, or from persons acting for third parties, in connection with financial portfolio management or independent fee-based investment advice, are attributed to, and passed on to, the client concerned.
(9) An investment services undertaking that designs financial instruments for sale must maintain, operate and review a process for approving each individual financial instrument and each material adaptation of existing financial instruments before the financial instrument is marketed or distributed to clients (product approval process). The process must ensure that a specific target market is determined, within the relevant category of clients, for each financial instrument intended for end clients. In doing so, all relevant risks to the target market must be assessed. It must further be ensured that the intended distribution strategy is consistent with the target market determined under the second sentence.
(10) An investment services undertaking must regularly review the financial instruments it offers or markets, taking into account all events that could materially affect the potential risk to the determined target market. It must at least regularly assess whether the financial instrument continues to meet the needs of the target market determined under subsection (9), second sentence, and whether the intended distribution strategy remains suitable for reaching that target market.
(11) An investment services undertaking that designs financial instruments must provide all distributors with all information necessary and appropriate regarding the financial instrument and the product approval process under subsection (9), first sentence, including the target market determined under subsection (9), second sentence. Where an investment services undertaking distributes or recommends financial instruments without designing them, it must have appropriate arrangements to obtain the information referred to in the first sentence from the designing investment services undertaking or from the issuer, and to understand the characteristics and target market of the financial instrument.
(12) An investment services undertaking that intends to offer or recommend financial instruments, and that distributes financial instruments designed by another investment services undertaking, must maintain suitable procedures and take measures to ensure compliance with the requirements of this Act. This also covers the requirements applicable to disclosure, to the assessment of suitability and appropriateness, to inducements, and to the proper handling of conflicts of interest. The investment services undertaking is under a duty of particular care where, as a distributor, it intends to offer or recommend a new financial product, or where the services it intends to offer or recommend as a distributor change.
(13) The investment services undertaking must regularly review its product approval arrangements to ensure that they remain robust and fit for purpose, and must take appropriate measures to implement any necessary changes. It must ensure that its compliance function, established under Article 22(2) of Delegated Regulation (EU) 2017/565, oversees the development and regular review of the product approval arrangements and identifies at an early stage any risks that the requirements of the product oversight process are not being satisfied.
(13a) Subsections (9) to (12) do not apply to investment services undertakings insofar as their investment service relates to bonds with a make-whole clause that have no embedded derivatives other than a make-whole clause, or where the financial instruments are marketed or distributed exclusively to eligible counterparties.
(14) The Federal Ministry of Finance may, by statutory instrument not requiring the consent of the Bundesrat, adopt further provisions on the application of Delegated Regulation (EU) 2017/565 and on the implementation of Commission Delegated Directive (EU) 2017/593 of 7 April 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council with regard to safeguarding of financial instruments and funds belonging to clients, product governance obligations and the rules applicable to the provision or reception of fees, commissions or any monetary or non-monetary benefits (OJ L 87, 31.3.2017, p. 500), as amended, and on the organisational requirements under subsection (1), second sentence, and subsection (7), the requirements for the product approval process and product distribution under subsection (9), the review procedure under subsection (10), and the information to be provided under subsection (11) and the related obligations of investment services undertakings. The Federal Ministry of Finance may transfer this authorisation, by statutory instrument, to the Bundesanstalt.