BRUBEG – Germany Embeds ESG Risks in Banking Supervision Law

On 19 June 2024, the EU Banking Package was published in the Official Journal of the European Union. The package strengthens banking regulation by overhauling both the Capital Requirements Regulation (CRR) and the Capital Requirements Directive (CRD). Germany transposed the package into national law through the Banking Directive Implementation and Bureaucracy Relief Act (Bankenrichtlinienumsetzungs- und Bürokratieentlastungsgesetz - “BRUBEG”), which entered into force on 1 April 2026. BRUBEG introduces sweeping changes across German prudential law - including the Financial Services Supervision Act and the Securities Institutions Act - but its most significant amendments target the German Banking Act (Kreditwesengesetz - “KWG”). 

Key Regulatory Changes at a Glance 

Among the headline changes is a new, EU-harmonised supervisory regime for third-country branches, imposing fresh requirements on branches and subsidiaries of non-EU firms operating in Germany. 

BRUBEG also introduces new notification obligations. Banks must now file notifications when acquiring or disposing of material assets or significant holdings, and when planning mergers or demergers. A fitness-and-propriety assessment - previously limited to members of the management board—now extends to members of governing bodies and holders of key functions. In addition, the Act introduces an output floor for own-funds requirements and periodic penalty payments as a new enforcement tool. 

We will examine each of these changes in detail in a forthcoming article series. In the weeks ahead, we will publish dedicated briefings on BRUBEG’s key amendments and their practical implications for bank management. This first instalment focuses on the changes relating to ESG risks. 

Embedding ESG Risks in the Risk Management Framework 

Beyond the structural reforms outlined above, BRUBEG harmonises the requirements for banks to integrate ESG risks into their risk management. The most material changes concern the management of ESG risks under the new Section 26c KWG and the newly introduced ESG risk plan under Section 26d KWG. 

Under Section 26d KWG, the ESG risk plan must address the financial risks arising from environmental, social and governance factors. Banks are required to monitor and manage these risks across short-term (up to one year), medium-term (three to five years) and long-term (more than ten years) horizons. They must set appropriate, quantifiable targets and key performance indicators, informed by the latest reports and measures of the European Scientific Advisory Board on Climate Change. Critically, the plan must be coherent with the institution’s other disclosures - including any voluntary sustainability report and other ESG-related publications. 

Small and non-complex institutions benefit from proportionate treatment under Section 26d(1). For these banks, a qualitative description of the risk profile may replace quantitative targets, and the use of the scientific advisory reports is discretionary. The requirement for coherence with other publications, however, still applies. 

Section 26c KWG introduces several additional obligations. Under Section 26c(1), banks must factor ESG risk appetite into their remuneration frameworks for executives and staff. Section 26c(2) requires managing directors to possess adequate ESG expertise, and Section 26c(6) extends this requirement to members of the administrative or supervisory body. Section 26c(3) mandates that institutions deploy sufficient resources to ensure the professional competence of senior management on ESG risks and their impacts. Finally, Section 26c(4) requires banks to embed ESG risks in their overall strategy, risk strategy, risk inventory and stress testing. 

Practical Implications: What Banks Should Do Now 

We recommend that affected institutions begin with a gap analysis, benchmarking existing processes against the new statutory requirements. Many of the obligations now formally codified in the KWG - such as integrating ESG risks into strategy, risk inventory and stress testing - are already established practice at larger banks. Smaller institutions, by contrast, have largely been spared these requirements to date and should review their governance frameworks as a priority. A likely gap for many institutions is the preparation of an ESG risk plan. As a first step, banks should define KPIs and metrics to monitor their ESG targets. They should then set limits, tolerance thresholds and escalation triggers. Finally, institutions must establish clear processes, responsibilities and practical workflows, including the implications for lending decisions. 

Baker Tilly brings deep expertise in governance and ESG implementation, delivering audit-proof, efficient solutions. We would be pleased to support you in your implementation projects.