Comments

Not only banks, but also outsourcing providers should take note of the new regime. While it may come as a surprise that the BaFin's jurisdiction extends to outsourcing providers across the globe if they have German-regulated customers, the burden will increase even more under the recently adopted EU Digital Operational Resilience Act (DORA). In addition, the need for regulated companies to comply with the new extensive notification obligations can be expected to lead to significant delays before outsourcing deals can be closed.

In more detail

Key changes introduced by the FISG

• Among other rules, particularly those increasing the obligations and liabilities of external auditors, the FISG also introduced an obligation for credit institutions and financial service institutions regulated by the German Banking Act (Kreditwesengesetz) (KWG) to notify the BaFin and the German Federal Bank (Deutsche Bundesbank) of the intent to outsource material activities, the implementation of such outsourcings, material changes thereto, and serious incidents in relation to such outsourcings. The same obligation was also introduced in the Securities Institutions Act (Wertpapierinstitutsgesetz) (WpIG) for investment firms, which entered into force in June 2021.
• Moreover, the FISG extended the already existing notification obligation for payment institutions and e-money institutions that are regulated pursuant to the Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz) (ZAG) with respect to the intent and implementation of all outsourcings to also include the obligation to notify in cases of material changes and serious incidents relating to material outsourcings.
• The FISG extended the already existing notification obligation for asset management companies (AIFM) pursuant to the Capital Investment Code (Kapitalanlagegesetzbuch) (KAGB) with respect to the intent and implementation of all outsourcings (not only material outsourcings) to also include the obligation to notify of any material changes (excluding serious incidents).
• The FISG also introduced statutory powers for the BaFin to take measures directly against outsourcing companies (i.e., the service providers as defined in the relevant laws, i.e., the KWG, the WpIG, the ZAG and the KAGB as well as the Insurance Supervisory Act (that already contained notification obligations for outsourcings)) and information obligations of the outsourcing companies, irrespective of their geographical location.
• Furthermore, the FISG introduced the obligation on outsourcing companies from non-EU jurisdictions to appoint a service of process agent in Germany.

BaFin now issued ordinances specifying the notification obligations

On 29 November 2022, the BaFin issued and amended ordinances that specify the notification obligations (in particular, the content of such notifications) and state that outsourcing notifications have to be made electronically through the MVP portal. The relevant ordinances include the following: the Notification Ordinance pursuant to the German Banking Act (Anzeigeverordnung), the Notification Ordinance pursuant to the Payment Services Supervision Act (ZAG Anzeigenverordnung), the Notification Ordinance under the Insurance Supervision Act (VAG Anzeigenverordnung zu Ausgliederungen) and the Notification Ordinance under the Capital Investment Code (KAGB-Auslagerungs-Anzeigenverordnung).

The referenced ordinances provide for extremely comprehensive requirements regarding the information that has to be provided with respect to an outsourcing notification, an amendment notification or the notification of a serious incident.

All notices have to be submitted electronically via the MVP portal. It is necessary to register for the MVP portal first before being able to submit outsourcing notifications. The BaFin provides instructions on its website found here.

After BaFin temporarily suspended the obligation to submit outsourcing notifications for credit institutions and financial services providers (that already came into effect on 1 January 2022), BaFin meanwhile stated that this suspension no longer applies and that the institutions that benefited from the suspension have to submit all notifications that were to be made since 1 January 2022 via the MVP portal by 1 March 2023.