BaFin updates circular on product oversight and governance arrangements for retail banking products - application to payment institutions

Regarding certain financial products, there are numerous product governance requirements. These stipulate that financial products must be designed and marketed in such a way that they primarily serve the interests of clients. The main objective here is consumer protection. The German Federal Financial Supervisory Authority (BaFin) has issued Circular 08/2023 - product oversight and governance arrangements for retail banking products (available in German here), in which it adopts the guidelines of the European Banking Authority (EBA - EBA-POG-GL, EBA/GL/2015/18) into German supervisory practice. These provide a framework for the oversight and governance of banking products, payment services and e-money products and formulate certain requirements for product manufacturers and product distributors. In light of the circular Minimum Requirements for Risk Management of ZAG institutions (institutions within the meaning of the Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz (ZAG) – payment institutions and e-money institutions) published on 27 May 2024 (ZAG-MaRisk, available in German here; see also BaFin consults on MaRisk for payment and electronic money institutions), BaFin updated the circular on product oversight and governance arrangements for retail banking products on 30 August 2024.

Requirements of the circular

The requirements of the circular apply to manufacturers and distributors of products that are offered and sold to consumers. The products in question are consumer loans and deposit products, payment services and e-money products. Product governance requirements are formulated for both manufacturers and distributors and the obligations are differentiated accordingly. Product manufacturers are undertakings that design products to be offered to consumers. In addition to CRR credit institutions, payment and e-money institutions also come into consideration. Product distributors are in turn undertakings that offer and/or sell the products to consumers or are responsible for marketing without being involved in the designing. The circular specifies how product manufacturers and distributors must monitor the products they design or distribute and organise their governance. The aim is to ensure that the manufacturing and distribution process for financial products is primarily orientated towards the interests of the customers. In this respect, specific requirements are set for internal processes, product design, product launch and product review. It is important here that the requirements relate to the entire life cycle of the financial products.

Organisational requirements - adaptation to the ZAG-MaRisk

According to BaFin, the provisions of the circular form an essential element of the general organisational requirements for institutions' internal control systems. In the previous version of the circular, reference was made to the Minimum Requirements for Risk Management for Credit and Financial Services Institutions (Mindestanforderungen an das Risikomanagement - MaRisk). However, the general MaRisk is not applicable to payment and e-money institutions, which are subject to the ZAG but not the KWG (German Banking Act - Kreditwesengesetz (KWG)). The passages relating to MaRisk only apply directly to KWG institutions.

ZAG institutions are also subject to risk management requirements. BaFin has now published minimum requirements for this for the first time. As a result of the amendments to the circular, the requirements that previously applied to KWG institutions now also apply directly to ZAG institutions due to the reference to the ZAG-MaRisk. In this respect, there is now more legal certainty. For example, when launching new products, BaFin expects the product manufacturer to ensure that the regulations for product oversight and governance as part of the authorisation strategy for new products (so-called new product process, NPP) are in line with the requirements of MaRisk and ZAG-MaRisk. In addition, the regulations for product oversight and governance must be integrated as part of corporate management and risk management in accordance with the applicable minimum requirements. This also applies to the responsibilities for the supervision of this process by the risk controlling and compliance function.

Implementation of the requirements

BaFin's circulars are of considerable importance in practice. They are not legally binding. However, they play a significant role in supervisory practice, meaning that institutions are effectively obliged to implement them. The undertakings concerned must therefore implement the requirements of the updated circular on product oversight and governance arrangements for retail banking products by 1 January 2025 in accordance with the deadline set by BaFin for implementing the ZAG-MaRisk. They should therefore already examine whether and to what extent adjustments to existing structures and processes are necessary. However, the editorial amendments to the circular will enter into force on 30 August 2024 due to BaFin's continued supervisory practice.

With the kind support of Apostolos Mitsios (research assistant).