DPIA

The wait is over
Ailance™ DPIA is here!

BaFin fine against UmweltBank AG for compliance violations

BaFin has sanctioned Umwelt-Bank for compliance deficiencies.
Categories:

On April 3, 2025, the German Federal Financial Supervisory Authority (BaFin) imposed fines totaling EUR 520,000 on UmweltBank AG. This was due to serious violations in UmweltBank's compliance organization over several years.

Background and facts

Specifically, BaFin found that UmweltBank AG's WpHG compliance function was inadequately staffed from 2020 to 2023 and that the compliance report for 2021/2022 was not submitted in full to the management. Due to these structural deficiencies, UmweltBank AG, a financial services provider from Nuremberg specializing in sustainable financing, violated central obligations of the German Securities Trading Act (WpHG).

In its communication, BaFin emphasizes that an appropriately equipped compliance function plays a key role in complying with regulatory requirements and protecting customer interests. In the case of UmweltBank, the deficits in the compliance organization prevented the management from fully fulfilling its supervisory and control responsibilities. The administrative order imposing the fine has been legally binding since April 25, 2025 after an initial opportunity to appeal.

Understaffing

The first breach of duty identified relates to the inadequate staffing of the compliance function in the period from 2020 to 2023. During this period, UmweltBank AG's compliance department was not staffed with sufficient qualified personnel to properly perform all of its monitoring and auditing tasks. This violated Section 81 para. 1 sentence 2 no. 1 a WpHG in conjunction with Section 80 para. § Section 80 para. 1 WpHG. This standard obliges the management of an investment services company to ensure an appropriate business organization. This also includes ensuring that the compliance function is adequately staffed.

In practice, such a staff shortage means that the bank was unable to fully implement legally prescribed monitoring and control measures (e.g. to prevent market abuse or to comply with investor protection regulations). The corresponding WpHG regulations serve the purpose of preventive supervisory control. They are intended to ensure that institutions have a proper organizational structure. In particular, Article 22 of Delegated Regulation (EU) 2017/565 (as a European concretization of MiFID II) stipulates that an investment service provider must establish and maintain a permanent, effective and independent compliance function. This function must be equipped with the necessary powers, resources and expertise to perform its duties properly. In this case, this requirement was not met for years, which BaFin considered to be a serious organizational deficiency.

Incomplete compliance reporting by UmweltBank

As a second violation, BaFin criticized the fact that the compliance report for 2021/2022 was not submitted in full to UmweltBank's management. This constitutes a violation of Section 81 (3) WpHG. According to this provision, the compliance officer is obliged to inform the management regularly and immediately of significant violations or risks. In practice, a comprehensive compliance report containing all relevant findings and risks must therefore be submitted to the management body at least once a year. Only complete and comprehensive reporting by the control functions provides the management with the necessary overview to take appropriate measures to comply with regulatory requirements.

Failure to disclose or incomplete disclosure of the compliance report jeopardizes the management's ability to meet its monitoring and control obligations. In addition, a failure to report on compliance may also constitute a breach of Section 91 (2) of the German Stock Corporation Act (AktG). This requires public limited companies to have a monitoring system in place to identify risks at an early stage. An incomplete organizational structure can impair overall corporate planning and management.

Legal basis and duties of the managing directors

The aforementioned obligations have been integrated into German law in recent years as part of the MiFID II regulation and are intended to ensure a robust compliance culture. § Section 81 (1) WpHG requires managers to establish and monitor an appropriate internal organization. Including sufficient human and financial resources for compliance. Specifically, Section 81 para. 1 sentence 2 no. 1 a WpHG stipulates that the management must "establish, implement and monitor an appropriate organization, including the necessary resources". According to BaFin's explicit interpretation, this includes adequate staffing of the compliance function.

In addition, Section 81 (3) WpHG stipulates that the management must have access to all information and documents necessary to fulfill its monitoring duties. Complete reporting by the control functions (compliance, risk management, etc.) is central to this, so that the management level is aware of the risk situation and any breaches at all times. This national provision mirrors the European requirements from Art. 22 of the Implementing Regulation (EU) 2017/565. In particular, Art. 22 para. 2 lit. c requires at least annual reports from the compliance function to the management body. In addition, Art. 22 para. 3 requires ad hoc reports in the event of significant risks and the independence and sufficient resources of the compliance function. Managing directors are therefore obliged to ensure that these compliance requirements are implemented. Failures in this area are considered breaches of the organizational duties of the management itself.

Reading tip: Compliance management in companies

Sanctions against UmweltBank due to compliance deficiencies

Violations of the organizational obligations under the WpHG can be punished by BaFin as an administrative offence with substantial fines. The law provides for sanctions of up to five million euros or ten percent of the company's total annual turnover, whichever is higher. In the case of UmweltBank, a severe fine of EUR 520,000 was imposed due to the compliance deficiencies, although this is well below the maximum limit. BaFin is likely to have taken into account the severity and duration of the violations (permanent understaffing for four years and failure to report) as well as the size of the institution and its cooperation in the investigation.

In principle, UmweltBank AG had the option of lodging an appeal against the fine. An appeal would have initiated legal proceedings in which the allegations would have been reviewed. However, the decision became final after a short period of time. As the bank did not lodge an appeal, the fine has become legally binding.

For the bank, this means not only a financial burden, but also reputational risks, as the BaFin notice is public. At the same time, the bank continues to be subject to special supervision: BaFin had already sent a special representative to UmweltBank in February 2024 to monitor compliance with WpHG obligations on site. The current sanction confirms that the supervisors continue to see a need for action.

Compliance fine against UmweltBank with signal effect

Smaller institutions in particular, which focus on sustainability or social banking, are faced with the challenge of fully meeting the growing regulatory requirements despite limited resources. Observers are wondering whether some of these institutions are structurally overstretched and where idealism ends and the duty of complete control begins. The case strikes at the heart of the self-image of some "value banks" and is likely to lead to a rethink of compliance priorities.

With this fine, BaFin is sending a clear signal to the industry: structural deficits in compliance are increasingly being punished consistently. While the financial supervisory authority used to be lenient in the case of first-time violations, the regulatory environment is moving towards lower tolerance thresholds - also due to strict EU requirements.

The BaFin decision underlines that a proper compliance organization is essential to ensure trust in the financial markets. Other institutions should therefore take the case as an opportunity to critically review their own compliance function and ensure that all requirements are met in terms of both personnel and processes. After all, incomplete compliance structures can result in considerable sanctions and reputational damage.

Source: BaFin announcement on UmweltBank AG

Tags:
Share this post :
en_USEnglish