BaFin has recently updated its Circular 08/2023 on Product Oversight and Governance for Retail Banking Products, which has an impact on the implementation of the ZAG-MaRisk
The German Federal Financial Supervisory Authority ("BaFin") has updated its Circular 08/2023 on Product Oversight and Governance for Retail Banking Products (Rundschreiben 08/2023 - Überwachung und Governance von Bankprodukten im Privatkundengeschäft, "Circular 08/2023"). The Circular 08/2023 sets out guidelines for the oversight and governance arrangements for banking products, payment services and e-money products offered to consumers by institutions subject to the German Banking Act (Kreditwesengesetz) and the German Payment Services Oversight Act (Zahlungsdiensteaufsichtsgesetz, "ZAG").
Update
The update was made to include references to BaFin's Circular 07/2024 (BA) on Minimum Requirements for Risk Management of German Payment Service Providers (Mindestanforderungen an das Risikomanagement von ZAG-Instituten, "ZAG-MaRisk"). The ZAG-MaRisk was published on 27 May 2024 and specifies risk management requirements for institutions subject to ZAG. The Circular 08/2023 now includes references to the relevant ZAG-MaRisk sections, such as the provisions on the new product process in AT 8.1 ZAG-MaRisk and the integration of the product oversight and governance into the risk control and compliance functions of the institutions in accordance with AT 4.4.1 and AT 4.4.2 ZAG-MaRisk. These updates will apply from 1 January 2025.
BaFin has also made editorial adjustments to the scope of application in margin number 6 b) and c) of the Circular 08/2023 which are in force since 30 August 2024.
The Circular 08/2023 is available here in German only.
Essential content of the Circular 08/2023
Product oversight and governance for product manufacturers
These provisions include guidelines on the establishment, proportionality, verification and documentation (Guideline 1), the product manufacturer's internal control functions (Guideline 2), the determination and updating of the target market (Guideline 3), product testing (Guideline 4), product monitoring (Guideline 5) and remedial measures (Guideline 6), distribution channels (Guideline 7) and information for product distributors (Guideline 8).
Product oversight and governance for product distributors
Guidelines 9 to 12 encompass also provisions on the establishment, proportionality, verification and documentation, the product distributor's governance, knowledge of the target market and information and support for the product manufacturer's provisions.
Outsourcing
Based on Circular 08/2023 it should be ensured that the requirements set out in AT 9 of the ZAG-MaRisk on outsourcing are met if the activity of product manufacturing and/or product distribution is outsourced in whole or in part to third parties or performed by another entity in some other way.
