Outsourcing – BaFin’s new notification procedure from 1 January 2022

The German Federal Financial Supervisory Authority (“BaFin”) was heavily criticised in light of the Wirecard scandal. One immediate consequence was a new act, the Financial Market Integrity Strengthening Act (Finanzmarktintegritätsstärkungsgesetz,“FISG”), which introduced numerous changes for audits and for outsourcing requirements (See our summary of the FISG here).

The new FISG outsourcing rules apply as of 1 January 2022 with various new notifications requirements around material outsourcing including sub-delegation and applicable to all types of regulated institutions. This includes notification obligations to BaFin

• when a regulated party intends to enter into a new outsourcing arrangement
• when it executes a new outsourcing agreement,
• when there are significant changes to an existing outsourcing agreement and
• when critical incidents occur.

These new requirements apply in addition to the EBA Outsourcing Guidelines which also introduced various new requirements for regulated entities including the establishment of a database including all outsourcing contracts.

BaFin had been expected to set out the long awaited practical approach for complying with the new obligations on 11 November. In the event, BaFin explained the general technical process required for the submission of the notification. However, the description remained rather abstract because the preparation of the relevant regulation has not yet been completed. The legal basis for the new regime will be implemented in the existing “Notification Regulation” and this is still in preparation. BaFin expects that the updated Regulation will be published before 1 January 2022 because generally market participants are required to apply the regime for new outsourcing agreements as of the start of next year. However, as this does not allow market participants sufficient time to prepare, BaFin does not expect market participants to file all notifications immediately after publication. In any event, market participants are not obliged to submit outsourcing notifications as long as the Regulation is not in force. For existing outsourcing contracts the new regime provides for a transitional period until 1 January 2023.

For all submissions market participants are required to use BaFin’s web-based reporting and publication platform (MVP). Only critical incidents must be filed through a different route – and this is not yet available. The regulator also expects to provide further details regarding these notifications before 1 January 2022.

As with other reporting obligations, the person making the notification can be the regulated entity, a group entity or a third party on behalf of the notifying party. The notifier must first register in order to be able to use the MVP portal. Notifying parties are then required to activate the new "Notification of outsourcing" procedure. Only once BaFin has granted authorisation for this special procedure can notifications be submitted.

For submission of notifications, the MVP portal offers the use of three different methods: (1) a web form, (2) a manual XML upload, or (3) the SOAP web service interface to upload the notification. Currently, the field descriptions for the upload are still to be finalised so it is not yet possible to complete the preparation. The necessary data fields need to be determined and these will be set out in the outstanding Regulation.

Have you ever thought about delegation of your outsourcing obligations? Simmons + Simmons is set up to satisfy the new BaFin requirements and we have the technical and legal solutions in place to ensure ongoing compliance with the new notification requirements.

Please let us know if you have any questions or you would be interested in our solutions.