Operational Resilience / Outsourcing in Germany

Key dates

June 2022 – March 2023

Period during which Barclays failed to submit 26 notifications

March 10, 2026

Date BaFin imposed the €1.65 million fine

March 27, 2026

Publication date of BaFin enforcement announcement

Four trading days

Maximum period to submit notifications after threshold event occurs

Suggested considerations

• *Audit existing processes: Conduct a comprehensive review of voting rights notification procedures, particularly for German-listed issuers, to identify any gaps or delays in submission timelines
• *Strengthen monitoring systems: Implement automated systems to track threshold events in real-time and flag notifications due within the four-trading-day window
• *Enhance organizational controls: Establish clear internal procedures, segregation of duties, and escalation protocols to prevent notification delays—BaFin specifically cited inadequate organizational measures in this case
• *Verify submission records: Maintain comprehensive documentation of all notifications submitted to BaFin and issuers, including timestamps and confirmation of receipt
• *Train relevant personnel: Ensure trading, portfolio management, and compliance teams understand the notification obligations and their respective responsibilities

What changed

• The enforcement action does not introduce new regulatory requirements but rather clarifies BaFin's enforcement posture regarding existing obligations under sections 33 et seq. of the WpHG.
• Notification thresholds: Shareholders must notify when voting rights reach, exceed, or fall below 3%, 5%, 10%, 15%, 20%, 25%, 30%, 50%, or 75%
• Notification timeline: Notifications must be submitted to both the issuer and BaFin within four trading days of the threshold event
• Scope expansion: Notifications apply to direct share holdings and certain financial instruments creating economic interest in shares
• Enforcement basis: BaFin can impose fines for individual contraventions or for breach of supervisory duties (failure to implement adequate organizational measures)

Key dates

01 February 2024

- Related BaFin/Bundesbank supervisory notice on cloud outsourcing (contextual reference)

18 December 2025

- Guidance issuance date

Suggested considerations

• Develop and approve AI strategy integrated with ICT roadmap and governance.
• Embed AI in existing ICT risk framework, ensuring lifecycle coverage with safeguards (e.g., testing, monitoring, decommissioning).
• Conduct third-party due diligence and contractual reviews for AI/cloud providers, including exit/portability testing.
• Implement AI-specific testing, documentation, and incident processes proportionate to criticality.
• Ensure management accountability for oversight, training, and interdisciplinary controls.

What changed

• The guidance does not introduce new binding rules but clarifies AI as ICT systems requiring DORA-compliant treatment, including:
• AI strategy: Management-approved, aligned with overall strategy, defining responsibilities, competencies, and interdisciplinary collaboration for critical functions.
• ICT risk management integration: Cover identification, protection, detection, response, recovery, training; apply to AI lifecycle (data acquisition, development, operation, retirement).
• Development and testing: Robust standards, documentation, testing proportionate to criticality; special focus on generative AI/LLMs, open-source, and code generation risks.
• Operational processes: Asset classification, monitoring, access controls, logging, anomaly detection, business continuity, secure decommissioning.