BRUBEG: Greater Accountability for Key Function Holders under the German Banking Act

Earlier articles in our BRUBEG series covered the changes relating to ESG risks and third-country branches. In this installment, we turn to the new fit and proper rules. Until now, supervisory fitness and propriety requirements have focused mainly on managing directors and members of supervisory bodies. For the first time, key senior staff below board level are now expressly brought within the regulatory fit and proper regime. 

BRUBEG does not stand alone. It puts on a statutory footing requirements that the European Banking Authority (EBA) and BaFin have applied for several years through guidelines and supervisory practice, including the EBA Guidelines on internal governance and the EBA Guidelines on the assessment of suitability. 

Below, we set out the key changes BRUBEG introduces in this area. 

Key functions move to the center of regulation 

Section 25e of the German Banking Act (Kreditwesengesetz, KWG), introduced by BRUBEG, sets out requirements for key function holders. Under Section 1(2b) KWG, key function holders are persons who have significant influence over the direction of the institution but are neither members of management nor of the supervisory or administrative board. Section 25e(3) KWG further distinguishes holders of special key functions. Section 1(2d) KWG defines these as “key function holders who perform special functions. These include the heads of the internal control functions and the head of finance, provided they are not managing directors.” This distinction is a feature of the German transposition: CRD VI does not differentiate between key functions and special key functions. 

The first step is to identify the institution’s key functions by documenting those functions, their holders and their skills. Under Section 25c(4a) No. 8 KWG, institutions must in future maintain a written overview of the tasks and individual responsibilities of managing directors, the management level directly below them and key function holders. 

The fit and proper requirements for managing directors and members of supervisory bodies now extend to key function holders. Under Section 25e(1) KWG, key function holders must be “professionally qualified and reliable.” Section 25e(2) KWG requires institutions to take the measures necessary to ensure that key functions are properly performed. In practice, and in line with BaFin Circular 11/2025, this means adopting suitability policies for the selection and appointment of key function holders and applying the principles used to assess the reliability and suitability of managing directors. Where a person is not suitable, Section 25e(2) KWG requires that they be replaced. At complex or high-risk institutions in particular, supervisors will increasingly scrutinize whether expertise genuinely matches the institution’s risk profile and business model. 

Institutions must also ensure that the heads of the internal control functions (such as risk control, compliance and internal audit) can report directly to the administrative or supervisory body where necessary. This goes beyond the previous requirements of AT 4.4 MaRisk (former version), under which these special control functions reported to management and their reports merely had to be forwarded to the supervisory body. In addition, the heads of these functions may now be removed only with the consent of the administrative or supervisory body. Under the former AT 4.4 MaRisk, a change in these special functions required only that the supervisory body be informed in advance, in good time and with reasons. 

Under Section 6(3) KWG, the supervisor can now also issue orders directly to key function holders who are responsible for a breach. This changes the nature of key functions: internal function holders will be held personally accountable by the supervisor for breaches. 

New notification obligations for large institutions 

BRUBEG also amends the notification obligations under Section 24 KWG for large institutions. 

Large institutions must notify the supervisor of the appointment and removal of key function holders. Appointment notifications must include information on the assessment of the individual’s suitability and reliability. 

Large institutions are also subject to a new advance notification procedure. Smaller institutions may notify the appointment of a managing director or the chair of the administrative or supervisory body promptly; large institutions must now give notice at least 30 business days before the individual is due to take up the role. The 30-business-day period allows the supervisor to intervene if it has concerns (for example, about time commitment or professional suitability) before the individual takes office. Section 24(2a) KWG also introduces an event-driven notification obligation. As soon as an institution becomes aware of new facts that could undermine the original assessment of reliability, professional suitability or expertise, it must notify BaFin and the Deutsche Bundesbank without undue delay. 

What to do now 

Responsibility for sound corporate governance will no longer end with the management board and the supervisory board. Heads of the central steering and control functions (the second management level) will become accountable in their own right and direct addressees of banking supervision. 

First, institutions should analyze their second management level and identify holders of key functions and special key functions. Second, they should assess the professional suitability and reliability of those individuals and implement a documented process for regular fit and proper assessments. Job descriptions, processes and written rules of procedure must also be updated to reflect the new reporting lines and consent requirements. Institutions should develop a training concept for key function holders, or otherwise ensure they attend relevant training every year to keep their expertise up to date. Large institutions should also review how to build the additional notifications into their existing reporting processes.