Focus on Governance

Significant provisions of the Banking Directive Implementation and Bureaucracy Reduction Act (BRUBEG) entered into force on April 1, 2026. Some changes directly affect the work and composition of bank Supervisory Boards and their committees. For example, there are new requirements regarding the qualifications of board members. In addition, institutions are now required to continuously monitor the suitability of key function holders.

BRUBEG is intended to transpose the EU Banking Package (consisting of CRR III and CRD VI) into German law with minimal bureaucracy. The focus is on increasing the crisis resilience of institutions through improved governance.

Supervisory Board Committees

The law clarifies that the statutory committee duties (Section 25d of the German Banking Act - KWG) fall to the full board if no committees have been established (or to the shareholders/owners if no supervisory body has been established either). Furthermore, certain duties of the individual committees have been refined and expanded. For example, when reviewing the incentives created by the compensation system, the Risk Committee must also take ESG risks into account.

Suitability of the Supervisory Board and Management Board

Institutions must ensure the suitability of board members also with regard to ESG risks as well as risks related to information and communication technology (ICT) systems and their implications. To this end, they must allocate appropriate resources, e.g., for board trainings.

The collective knowledge of the Management Board members regarding the institution’s main risks must now explicitly include ESG risks.

If members of the Management Board/Supervisory Board (no longer) meet the suitability requirements, they may not be appointed or must be removed from office immediately.

Qualifications of Key Function Holders

Key functions holders have been newly included in the law. These are individuals who have a significant influence on the management of the institution but are not members of the Supervisory/Management Board. “Special” key functions, which the law now explicitly names, include internal control functions, i.e., risk control and compliance functions as well as internal audit.

The same suitability requirements now apply to all key functions holders as to the Management Board and Supervisory Board. They must be professionally qualified and reliable at all times. This must be monitored by the institutions on an ongoing basis (i.e., through regular and ad hoc suitability assessments). Individuals who no longer meet the suitability requirements must be replaced.

In large institutions, there is now also a supervisory assessment of the suitability of holders of “special” key functions.

Status and Independence of Internal Control Functions

With regard to the heads of internal control functions, the law clarifies that they must, on the one hand, have sufficient authority and, on the other hand, have direct access to the Supervisory Board. This is intended to ensure that they can raise concerns directly with the Supervisory Board and issue warnings about risky developments. Furthermore, they may no longer be relieved of their duties without the consent of the Supervisory Board.

In addition, the risk control and compliance functions must be independent of operational business. The internal audit function may not be combined with other business areas or control functions.

Overview of Responsibilities

Institutions are now required to prepare an overview of the duties and responsibilities of members of the Management Board, members of the first level below the Management Board, and key functions holders. Additional requirements in this regard are to be introduced through the “EBA Internal Governance Guidelines” and the “Minimum Requirements for Risk Management (MaRisk).” Both are currently being revised accordingly.