BRUBEG: What Is Changing For Regulated Financial Institutions Now

The Banking Directive Implementation and Bureaucracy Relief Act (Bankenrichtlinienumsetzungs- und Bürokratieentlastungsgesetz, BRUBEG), passed by the German Bundestag on 29 January 2026 in the amended version of the Finance Committee (BT Drs. 21/3897), marks one of the most consequential reforms to the German banking supervisory framework in recent years. It transposes Directive (EU) 2024/1619 (CRD VI) into national law and introduces profound adjustments across, e.g. third country branch regulation, governance, ESG related risk management, corporate transactions and supervisory powers. The bulk of the changes are expected to enter into force at the beginning of Q2 of 2026, at the latest. That leaves institutions with a narrow window to assess impacts and implement necessary changes. 

At European level, CRD VI and Regulation (EU) 2024/1623 (CRR III) complete the finalisation of Basel III and aim to harmonise supervisory expectations, particularly concerning core banking services such as deposit taking, lending, and guarantee business. BRUBEG incorporates these rules into German law (notably the German Banking Act – KWG), with the objective of ensuring consistent EU wide market access rules and strengthening the resilience of the financial sector. 

Harmonized regulatory regime for third country branches

One of the most transformative elements of BRUBEG is the new regulatory regime for CRD third country branches. Institutions headquartered outside the European Economic Area that provide cross-border core banking services into Germany (or other member states of the EU) will, going forward, require an explicit authorisation as a CRD third country branch. This is not in itself a major change compared to the current regime in Germany, where branches of third country firms require an authorisation even if they provide non-core banking services. However, the new rules under the BRUBEG establish a customized regime for obtaining such authorisation as a CRD third country branch with detailed capital and liquidity requirements as well as internal governance requirements.

Under certain conditions, the German Federal Financial Supervisory Authority (BaFin) may even require the establishment of a subsidiary. This is the case, for example, when the combined EU assets of all third‑country branches of the same group reach EUR 40 billion, or when the assets of the German branch alone reach EUR 10 billion (see sec. 53 ci KWG as amended by BRUBEG (KWG-amended)). 

To the extent the CRD third country branch regime applies (i.e. with respect to core banking services), third country firms will not be allowed to render services to German customers on a cross-border basis. Consequently, existing waivers for such cross-border services under sec. 2 para. 5 KWG will likely be revoked by BaFin. However, genuine reverse solicitation remains unaffected under the CRD VI framework.

A transition period until 11 January 2027 provides limited time for institutions that are not yet operating through a legal entity established in the EU to reorganize their operating models to continue conducting banking services in Germany.

Governance 

Governance reforms under BRUBEG further heighten the supervisory focus on fit and proper assessments. Key function holders will be subject to fit and proper requirements (see sec. 25e KWG-amended). BRUBEG

• further strengthens internal control functions through the express requirement that these functions must be independent (see sec. 25a para. 1 KWG-amended);
• formalises direct reporting lines of the heads of internal control functions to the supervisory board (see sec. 25c para. 4a KWG-amended); 
• extends supervisory intervention rights to key function holders (see sec. para. 3 KWG-amended); and 
• prohibits combining the internal audit function with other control functions or business units (see sec. 25a para. 1 KWG-amended).

Moreover, BRUBEG affords the heads of internal control functions special protection, as they may only be stripped of their responsibilities with the express consent of the supervisory board (see sec. 25c para. 4a KWG-amended). 

Early stage notifications of new management board members and chairs of the supervisory board to BaFin and Bundesbank, at least 30 working days prior to appointment, will become mandatory for large institutions (see sec. 24 para. 1 no. 1 and 4 KWG-amended).

Institutions must ensure that their governance frameworks, role descriptions, and suitability processes reflect these more stringent expectations.

Requirements governing ESG risks 

Equally far reaching are the new statutory requirements governing ESG risks. For the first time, the KWG (as amended by BRUBEG) explicitly mandates the systematic identification, assessment, and management of ESG risk drivers. 

Secs. 26c and 26d KWG-amended introduce a legally binding ESG risk plan as a core component of risk strategy and governance, moving beyond the supervisory guidance as currently published by BaFin. The scope and degree of detail of the plan shall be determined by the institution’s specific nature and size, thereby ensuring a risk‑based and proportionate implementation.

This elevates ESG considerations from supervisory expectations to enforceable legal duties, requiring institutions to establish robust methodologies, data processes, and governance structures. While the principle of proportionality applies, particularly for smaller or less complex institutions, the enforceable requirements will increase for all market participants.

Corporate transactions

In addition, BRUBEG introduces new tools that materially affect corporate transactions. If an institution intends to 

• carry out a significant transfer of assets or liabilities; 
• effectuate an internal reorganisation; or 
• acquire a qualifying holding in another company;

it must notify this to the regulatory authorities and the execution of such transactions is subject to mandatory waiting periods. 

For example, if a CRR credit institution, financial holding company or mixed financial holding company intends to acquire a participation in another company that exceeds 15% of the acquiror's eligible capital it must notify the competent authority in advance and, in essence, seek approval from the authority (see sec. 2h KWG-amended). The intended disposal of such a participation must be notified as well (see sec. 24 para. 1f KWG-amended)

CRR credit institutions, financial holding companies and mixed financial holding companies must notify any intended merger or demerger to BaFin after adoption of the transaction plan and before completion if BaFin is responsible for supervising the resulting entity (see sec. 2i KWG-amended). The merger or demerger must not be completed before BaFin has granted its approval. 

The supervisory authorities must process the aforementioned notifications within 60 working days (subject to certain extensions if the authorities have follow-up questions).

Additionally, intended significant transfers of assets or liabilities must be notified in advance with notification required from all entities involved and irrespective of whether the transaction is internal or involves external parties (see sec. 24 para. 1f, 3a no. 8 KWG-amended). A significant transfer of assets or liabilities is defined as a transfer of assets or liabilities that affects at least 10% of the transferor's total assets or liabilities (15% in case of intra-group transfers) (see sec. 1 para. 9a KWG-amended).

These rules align with broader European efforts to mitigate prudential risks arising from M&A activity and require institutions to integrate regulatory assessments early in transaction planning to avoid delays or impediments.

Periodic Penalty Payments

BRUBEG introduces the concept of periodic penalty payments to German law (see sec. 50 KWG-amended). Periodic penalty payments are already an established tool in European supervisory law (see Regulation (EU) No 806/2014 (Single Resolution Mechanism Regulation) and Regulation (EU) 2024/1624 (Anti Money Laundering Regulation)). 

In essence, periodic penalty payments are administrative sanctions that may be imposed on an institution or a natural person to compel the addressee to comply with regulatory obligations. Natural persons include, in particular, managing directors, members of the management or supervisory board, key function holders and material risk takers, but also any other natural person responsible for the breach.

Periodic penalty payments under BRUBEG accrue daily for as long as the breach of regulatory obligations subsists (but at the maximum six months) and can reach up to 5% of average daily net turnover per day (see sec. 50 para. 4 KWG-amended). The daily net turnover is to be calculated in accordance with sec. 50 para 5 KWG-amended, which exhaustively lists the items of the institution's latest available profit and loss statement that are to be included in the calculation. If the institution is part of a group of companies, the calculation is based on the group's consolidated profit and loss statement. If the penalty payment is imposed upon a natural person, the maximum daily penalty is EUR 50,000. 

Bureaucracy Relief

Despite this expansion of regulatory expectations, BRUBEG also delivers measurable relief, particularly for smaller and less complex institutions. These include, inter alia:

• the increase of the disclosure threshold to EUR 1.5 million above which lenders are required to obtain information on the borrower’s financial circumstances, in particular through the submission of annual financial statements (see sec. 18 KWG-amended); 
• easing the conditions under which transactions between the institution on the one hand and its board members or other affiliates on the other hand must be made at arm's length and approved by the institution's entire board (see sec. 15 KWG-amended); and 
• the removal of duplicative licensing requirements for credit institutions engaging in crypto-related activities (see sec. 32 para. 1f KWG-amended).

The National Regulatory Control Council (Nationaler Normenkontrollrat) estimates annual economic benefits of approximately €89 million, including €2 million in reduced bureaucracy costs, against a one-time implementation burden of around €28 million.

The German legislator has emphasised proportionality and committed to further reducing excessive reporting obligations while maintaining supervisory standards. Institutions should actively leverage these relief measures where available.

Key Takeaways

BRUBEG represents a significant tightening and modernisation of the German banking regulatory framework by fully embedding CRD VI into national law. While BRUBEG establishes additional substantive requirements in areas such as third‑country branches, internal governance, ESG risk management and corporate transactions, and introduces new enforcement tools (such as periodic penalty payments), it simultaneously features targeted bureaucracy relief measures. Institutions operating in or into Germany should act swiftly to assess their exposure, leverage available simplifications, and ensure timely compliance ahead of the upcoming implementation deadlines.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.