Germany

Sets out BaFin's binding interpretation of the governance-system provisions of the VAG and Delegated Regulation (EU) 2015/35 for insurers, reinsurers and insurance groups, and abrogates Circular 02/2017 (VA). The circular states it comes into force on 14 October 2025; BaFin's page is dated 14 January 2026.

Enacted on 27 December 2024 and, according to section 1, implements Regulation (EU) 2023/1114 (MiCA). Section 3 sets the duties of BaFin, section 4 its general powers and section 5 the immediate enforceability of certain measures. BaFin's page on crypto institutions says the Act also governs notification and reporting duties (section 21), with a reporting regulation expected in 2026. The text opened was last amended by Article 21 of the Act of 25 March 2026.

EU 'travel rule' for funds and crypto-asset transfers, adopted 31 May 2023. Article 14 sets the information that the originator's crypto-asset service provider must attach to a transfer, and Article 40 states that the Regulation applies from 30 December 2024.

DORA (Digital Operational Resilience Act) is a supreme regulatory framework for Europe that has been put together to ensure that all financial institutions in the EU are able to withstand, respond to, and recover from any ICT disruptions and cyberattacks. The new regulation comes at a time when countries such as Germany had BAIT, whereas France had sector-specific national guidelines for ICT risk management in place. This new legislation serves to connect the dots between financial stability and digital security through its extraordinarily wide scope, which covers more than 22,000 entities in 20 different categories of finance, such as credit institutions, investment firms, CASPs, crowdfunding platforms, and, most importantly, critical third-party ICT service providers, including large cloud computing providers.

Law on Tracing Proceeds of Serious Crimes, widely referred to by the name of its home country as Geldwäschegesetz (GwG), is the key statutory act of the Federal Republic of Germany that acts as the shield to safeguard the national economy from money laundering, tax evasion, and terrorist financing schemes. Initially adopted by the German Bundestag in 1993 and later revised significantly in 2017, this landmark legislation provides for the transposition of European Union anti-money laundering directives into the domestic legislation. It is a legislation enforced through the rigorous scrutiny of BaFin and Financial Intelligence Unit (FIU) that currently operates and remains in force with its most recent structural revisions effective as of 29 June 2026, adjusting domestic provisions to the European transparency registers. Under the terms of the GwG, all kinds of institutions, including traditional banks, real estate agents, gambling facilities, high-value goods traders, and crypto-asset service providers (CASPs), are mandated to implement adequate AML compliance programs. Among other things, the GwG requires thorough Customer Due Diligence (KYC/CDD) procedures, a 5-year financial trails record retention requirement, and a zero-tolerance approach to Suspicious Transaction Reporting (STR) procedures.

BAIT is a binding administrative circular (Rundschreiben) of the German financial supervisory authority BaFin, which is intended to facilitate the translation of the legal regulatory banking framework into technical and organizational standards. It was originally introduced in 2017 and is known as Bankaufsichtliche Anforderungen an die IT. BAIT is regarded as the main technical module that works in conjunction with the general MaRisk framework, specifying particular requirements for information security and IT systems. In its present phased sunset period, BAIT acts as a transitional tool toward the supreme DORA regulation of the EU. Major actors of the financial system have been exempted from BAIT since 17 January 2025 due to their necessity to comply only with DORA, while other financial institutions operating in Germany will be obligated to follow the January 2025 version of BAIT until its total repeal on 31 December 2026.

The General Data Protection Regulation (GDPR) is the most robust privacy law globally since it provides individuals with total control of their personal information while ensuring there is a uniform digital privacy rulebook for modern companies. The regulation came into force in 2016 and began its implementation in 2018, replacing the outmoded 1995 Data Protection Directive and changing the global privacy landscape through the inclusion of extraterritoriality. This implies that the regulation is applicable strictly to any entity worldwide, processing, storing, or handling the personal information of EU citizens without considering the company’s physical location. The GDPR is enforced at the national level by independent data protection authorities, including the BfDI and state data protection bodies in Germany or CNIL in France. It ensures that data privacy is a basic human right with hefty administrative fines of up to €20 million or 4% of a company's global annual turnover being applied to entities failing to comply with the regulation.

Dated 16 April 2014; repeals Directive 2003/6/EC and three Commission Directives (EUR-Lex). BaFin's 2025-2026 fine notices apply Article 17(1) (disclosure of inside information), Article 19(1) (managers' own-account transactions) and Articles 12 and 15 (market manipulation).

The Wertpapierhandelsgesetz (WpHG) is the fundamental legislative act in Germany, aimed at investor protection, confidence-building, and the structural soundness of its securities and derivative market. It is enforced strictly under the sovereign public supervision of BaFin, where the WpHG creates a complete set of legal guidelines for all trading activities, whether within or outside the organized stock exchange. The broad jurisdiction of the law includes investment services firms, issuers, investors, and market infrastructures. This act is the fundamental legal basis which implements the EU investor protection laws into the German corporate law and gives the regulator authority to ban trading, warn investors publicly, and conduct an audit of market operators.

The Kreditwesengesetz (KWG) represents Germany’s fundamental statute for banking regulations, formulated with the objective of protecting depositors, securing the safety of assets held by financial companies, and avoiding any structural disturbance in the economy of the nation. The Kreditwesengesetz is regulated through a two-tier structure by BaFin (as the sovereign regulator) and the Deutsche Bundesbank (as the operational auditor). All credit institutions and financial services institutions operating in Germany are governed under the Kreditwesengesetz. The Kreditwesengesetz acts as the ultimate instrument for implementing the prudential directives of Europe into German corporate law.

Section 12 requires employers to set up an internal reporting office (employers normally employing at least 50 people; section 12(3) lists entities that must do so regardless of size). Section 19 sets up the Federal External Reporting Office at the Federal Office of Justice, and section 21 makes BaFin the external reporting office for certain financial-sector reports. Section 40 sets fines of up to EUR 50,000, EUR 20,000 or EUR 10,000 depending on the breach. The English translation includes amendments made by the Act of 27 December 2024.

Section 30 provides for regulatory fines on legal persons and associations of persons, and a chapter on violation of obligatory supervision in operations and enterprises sits alongside it. BaFin's October 2026 fine on Nomura Holdings cites the OWiG for the duty to put supervisory measures in place. The English translation includes amendments made by the Act of 22 December 2025.

Section 1 sets the minimum wage; Division 3 covers control and enforcement by governmental agencies (section 14 competence, section 17 keeping documents available, section 21 regulatory fines). The English translation includes amendments made by the Act of 28 June 2023.

Supplements the GDPR. Part 2 covers the legal basis for processing (sections 22 to 31), data subject rights (32 to 37), controller and processor duties including data protection officers of private bodies (38 and 39), supervisory authorities for private bodies (40) and penalties (41 to 43). The English translation includes amendments made by the Act of 23 June 2021 and the German version may be more current.

Division 2 protects employees against discrimination, section 13 gives a right of complaint, and section 25 sets up the Federal Anti-Discrimination Agency. The English translation includes amendments made by the Act of 22 December 2023.

The English translation includes section 261 (money laundering), section 263 (fraud), section 264a (capital investment fraud), section 266 (embezzlement), section 299 (taking and giving bribes in commercial practice), sections 331 and 332 (accepting benefits, taking bribes) and sections 202a, 202c, 303a and 303b (data espionage, preparatory acts and phishing, data manipulation, computer sabotage). The translation includes amendments made by the Act of 7 November 2024.