The German Banking Act (KWG)

The act took effect in 1935 and was rewritten in 1962, and it is the German implementation of the Basel accords from Basel I to Basel III, according to its Wikipedia entry. Its purpose is to keep banks working and to protect creditors from losing their deposits.

Section 1 defines what is regulated. Its list of banking business has twelve entries, among them deposit taking, lending, the safe custody of securities, guarantee business, underwriting and central counterparty services. Financial services add investment advice, portfolio management, proprietary trading, the operation of trading facilities and a qualified crypto custody business for cryptographic instruments and the private keys that control them.

Anyone who conducts banking business or provides financial services commercially, or on a scale that needs a commercially organized operation, needs written permission from BaFin under section 32. The application proves the initial capital, names the managers and shows that they are reliable and professionally qualified, and contains a business plan with the types of business, the organizational structure and the internal controls. It also covers the significant shareholders. BaFin can attach conditions and can limit a license to single services.

For a fintech, the first question about a product with deposits, loans or client portfolios in it is whether the activity falls under section 1, and if it does, whether the firm applies for its own license or works under the license of a partner bank. Banking as a service in Germany covers the partner bank route.

Section 25a requires a proper business organization, and the list behind the phrase is long: business and risk strategies, procedures for risk-bearing capacity under stress, an internal control system with an independent risk control function and an independent compliance function, an internal audit, emergency management with a focus on IT systems, and a process that lets employees report violations while their identity stays confidential. The risks it names include ESG and concentration risks over the short, medium and long term.

BaFin spells these duties out in the MaRisk circular. Section 25b adds the rules for outsourcing, covered on outsourcing and cloud in German banks, and Section 25a also asks for a process through which employees can report breaches while their identity stays confidential.

BaFin and the Deutsche Bundesbank share the work under section 7. The Bundesbank runs ongoing supervision: it evaluates the documents and audit reports banks submit and assesses their capital and risk management. BaFin takes the supervisory measures, such as general orders and administrative acts, and usually bases them on the Bundesbank's findings. For the largest banks, both authorities work within the European Central Bank's single supervisory mechanism.

Section 18 requires a credit institution to have a borrower disclose its financial circumstances, mainly through annual financial statements, when a loan exceeds 1.5 million euros or 10 percent of the institution's tier 1 capital. The bank can waive this when collateral or co-obligors make the request obviously unfounded, and loans to central governments and central banks are exempt.

Section 24c obliges credit institutions to keep a file of every account and custody account with the holder's name, address and date of birth, the authorized persons and the beneficial owners. BaFin can query it automatically at any time, and the bank must not learn of the queries. The data is deleted ten years after the account closes. Prosecutors, customs and the financial intelligence unit can request information through BaFin.