BRUBEG and CRD VI: New Regime for Third-Country Branches

With the Banking Directive Implementation and Bureaucracy Reduction Act (Bankenrichtlinienumsetzungs- und Bürokratieentlastungsgesetz, BRUBEG), the German legislature has implemented the requirements of CRD VI and fundamentally reshaped the regulatory framework for third-country banks. 

A new, standalone supervisory regime has been created for institutions from third countries. Sections 53c to 53cq of the KWG, as amended, comprehensively regulate, for the first time, the authorization, organization and supervision of so-called CRD third-country branches (TCBs). 

The end of the legal fiction of branches as credit institutions 

Under the previous legal framework, a German branch of a third-country institution was formally deemed a credit institution (legal fiction), with extensive supervisory relief. The definition of a CRD third-country branch covers branches whose foreign parent would qualify as a CRR credit institution if it were headquartered in the European Union (the credit institution status criterion) and that conduct lending or guarantee business in Germany, as well as all branches that themselves conduct deposit-taking business (the core banking services criterion). 

Authorization application and re-authorization process 

There is no unconditional grandfathering for a German branch of a third-country institution. The following authorization requirements apply: 

Authorization requirement: CRD third-country branches require authorization from Bafin if they wish to conduct deposit-taking, lending or guarantee business in Germany on a commercial basis or through a business operation organized on commercial lines. 

Core conditions for authorization: Authorization requires the branch to meet the applicable minimum requirements; the regulated services to be covered and supervised by the third-country parent; the application for the CRD third-country branch to be submitted to the competent supervisory authorities in the third country; and Bafin to be able to cooperate effectively with the third-country supervisor, with no reasonable suspicion of money laundering or terrorist financing. 

Re-authorization: Bafin may decide that authorizations granted before 10 January 2027 to existing CRD third-country branches remain valid, provided the affected branches fully meet the new requirements, including those relating to own funds, governance, liquidity buffers and risk management. Bafin may require the submission of management qualifications, booking policies and liquidity plans; in practice, this amounts to a simplified new authorization process. 

Classification of CRD third-country branches into risk classes and qualifying branches 

BRUBEG introduces a proportionality model. CRD third-country branches are classified into two categories based on their systemic importance and risk profile (Class 1 and Class 2), unless they qualify as a so-called qualifying CRD third-country branch. The EBA has published guidelines on the authorization of branches from third countries (EBA/GL/2026/08) and EBA/RTS/2026/02. Systemic importance is also presumed where the aggregate EU-wide assets of all CRD third-country branches within the same group are equal to or higher than EUR 40 billion (based on a 3-year average). If Bafin determines that a branch is systemically important, it may impose risk-mitigating measures. 

New substantive supervisory requirements for CRD third-country branches: Substance instead of an “Empty Shell“ 

Capital endowment: The capital endowment must be deposited in the form of unencumbered, liquid assets in a separate escrow account with an institution authorized in Germany or with Deutsche Bundesbank. Branches must maintain a minimum capital endowment at all times, with the amount determined by their risk class. The EBA has issued guidelines on capital endowment requirements for branches from third countries (EBA/GL/2026/03), which govern the classification of instruments eligible as capital endowment. 

Liquidity requirements: Class 1 CRD third-country branches must meet the regulatory liquidity requirements applicable to CRR credit institutions under the CRR, such as the liquidity coverage ratio (LCR). Class 2 CRD third-country branches must hold sufficient unencumbered liquid assets to cover outflows for at least 30 days. As with the capital endowment, these liquid assets must be held with Deutsche Bundesbank or an unaffiliated institution in Germany. 

Governance and risk management: Branches may no longer operate merely as sales or booking offices without their own management personnel. Adequate local human and technical resources are mandatory. All CRD third-country branches must appoint at least two persons resident in Germany who effectively direct the business. In addition, CRD third-country branches in both Class 1 and Class 2 must comply with extensive regulatory requirements. Class 2 benefits from two exemptions, relating to internal control functions and requirements applicable to supervisory bodies, although Bafin may withdraw them based on the branch’s size or complexity. 

IT and outsourcing: CRD third-country branches must establish reporting obligations covering all material risks to the management body of the parent company. Risks arising from information and communications technology systems (ICT) and outsourcing arrangements must also be closely monitored. As part of the annual financial statement audit, an annual assessment must be conducted to determine whether these governance and risk requirements are being met; the results must also be reported to Bafin and Deutsche Bundesbank. 

Bookkeeping and financial reporting: The CRD third-country branch must maintain separate books in accordance with the German Commercial Code (HGB) and must prepare and have audited each year a statement of assets and liabilities, an income and expense statement and notes. To provide further detail, the EBA has published a draft RTS, currently under consultation, on booking arrangements for CRD third-country branches (TCBs) (EBA/CP/2025/16). 

Reporting obligations: CRD third-country branches must report their assets and liabilities to Deutsche Bundesbank. They must also provide evidence of compliance with the legal and regulatory requirements applicable to the branch (supervisory status), details of supervisory conditions, and ad hoc reports to the relevant deposit guarantee schemes. In addition, CRD third-country branches must provide the supervisory authorities with information about the parent company. These reports must be made at least semiannually (Class 1) or annually (Class 2). 

The end of cross-border services: Section 2(5) KWG and reverse solicitation 

The BRUBEG also has significant indirect consequences for the active provision of cross-border services from a third country: 

Domestic scope: A branch authorization strictly limits business activities to Germany. CRD third-country branches have no passporting rights. 

Branch requirement: Anyone wishing to provide core banking services (deposit-taking, lending and guarantee business) to customers in the European Economic Area (EEA) must maintain a physical branch or subsidiary. Existing exemptions will be reassessed. While contracts entered into before 11 July 2026 are grandfathered, the new regime applies to new business from 11 January 2027. 

Strict reverse solicitation (customer-initiated business) as the remaining exception: Providing banking services without authorization remains permissible only if the German customer can demonstrate that it initiated the transaction at its own exclusive initiative. 

Power to require conversion into a subsidiary: Subsidiarization 

One of Bafin’s most far-reaching powers is to order the conversion of a CRD third-country branch into a legally independent subsidiary (compulsory subsidiarization). This most severe supervisory measure may be taken in particular if any of the following conditions applies: 

Conducting impermissible cross-border activities: The CRD third-country branch offers services to customers in other EU Member States. 

Exceeding defined thresholds: Exceeding the defined “EU group threshold” or “domestic asset threshold” triggers a statutory presumption in favor of enhanced supervisory review. 

Systemic importance and risks: Systemic importance indicators have been defined for classifying the branch. 

Bafin may also order conversion even if these indicators are not met, including where cooperation with the third-country supervisor is inadequate or materially deficient, or where the foreign parent’s resolvability in insolvency cannot be ensured. 

Action required for affected institutions and conclusion 

Affected CRD third-country branches must promptly review their balance-sheet structure, booking models and local management functions to determine their risk classification and any available exemptions, rule out deficiencies in local substance, and plan for the required capital endowment and liquidity. 

Cross-border distribution strategies must be realigned. Going forward, customer relationships must be placed on a legally sound footing through a branch, an EEA subsidiary or strictly documented reverse solicitation. 

Finally, governance must be adapted to the new management requirements to complete the comprehensive re-authorization dossier. 

The new CRD VI regime ends the era of pragmatic national workarounds for third-country banks. The German market remains open to international institutions from third countries, but the regulatory costs of market entry and participation are increasing. Institutions must review their governance, booking and sales models to avoid regulatory breaches and, in the worst case, forced restructuring.