Germany: Compliance

The European Union's Cyber Resilience Act introduces mandatory cybersecurity requirements for products with digital elements, with critical notification obligations taking effect in September 2026.

Germany's financial regulator BaFin has issued new supervisory guidance on virtual IBANs, addressing concerns about transparency in payment flows and beneficial ownership while affirming that vIBANs remain legitimate payment infrastructure. The communication requires firms to demonstrate that their governance, customer transparency and monitoring arrangements have kept pace with technological innovation, particularly in relation to anti-money laundering and counter-terrorist financing controls.

The European Central Bank has issued an urgent directive to major financial institutions requiring comprehensive action plans to counter rapidly evolving cybersecurity threats powered by frontier artificial intelligence models. With an October 2026 deadline looming, banks must demonstrate concrete measures across vulnerability management, monitoring capabilities, and third-party risk controls as AI-enabled attacks compress the timeline between threat discovery and exploitation. This supervisory escalation s