Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

The number to hold onto is 1,089. Nearly every German bank, including essentially every mid-sized one, is supervised by BaFin and the Bundesbank, not by the ECB. Entities can be looked up in BaFin's company database.

Which regulations does BaFin enforce?

The German acts: KWG (banking), WpHG (securities trading), VAG (insurance), KAGB (investment), ZAG (payment services), WpIG (securities institutions) and GwG (anti-money laundering). Recent 2026 fine decisions cite section 57 GwG together with section 60b KWG or section 84 WpIG: the AML provisions are doing visible enforcement work.

On EU files, BaFin is the German competent authority for DORA (733 serious ICT incidents were reported to supervisors by the end of 2025) and for MiCA, through the Kryptomärkteaufsichtsgesetz (KMAG), with a related notification ordinance expected to enter into force during 2026 (BaFin on crypto institutions).

On the AI Act, BaFin was designated market surveillance authority for AI systems used by financial entities under Germany's implementing law, in force since 29 July 2026. Transparency obligations apply from 2 August 2026 and high-risk requirements from 2 December 2027 (BaFin press release, 29 July 2026). Germany therefore has a designated financial-sector AI supervisor while the Netherlands is still legislating.

What does BaFin publish, and how often?

Circulars (Rundschreiben), numbered per directorate: BA for banking, VA for insurance, WA for securities, GW for money laundering. Consultations. The annual report, presented at an annual press conference each spring (the 2025 edition on 12 May 2026). Risiken im Fokus, its annual risk outlook (2026 edition on 28 January 2026). The BaFinJournal article series. Individual enforcement measures. It maintains 24 distinct databases and overviews, including the company database, the ZAG institutions register and lists of Pfandbrief banks and systemically important institutions. There are five RSS feeds: all publications, press, supervisory practice, enforcement measures and circulars (RSS overview).

What does BaFin's enforcement look like?

2025, in BaFin's own year-end figures: 151 announced supervisory measures, €80,937,500 in fines, 46,543 complaints received and 1,875 whistleblower submissions (Annual Report 2025).

Individual 2026 measures include an order to the Frankfurt branch of the State Bank of India requiring a proper business organisation (13 August 2026), a fine to Leo International Precision Health AG under section 40c WpHG (30 July 2026), a similar order to Crefo Factoring Westfalen (28 July 2026), the withdrawal of Bochumer Versicherungsverein's insurance licence under the VAG (22 July 2026), a fine to Raiffeisenbank Lech-Donau under the KWG, WpIG and GwG (9 July 2026), a fine to Van Lanschot Kempen Investment Management under section 40c WpHG (27 May 2026) and a fine to Volksbank Senden (11 May 2026).

Compare the scale with the Netherlands: BaFin's €80.9 million in 2025 fines against the AFM's €16.7 million and DNB's roughly €14 million across the last twelve months. The German enforcement surface is materially larger, and the mid-sized cooperative and savings banks are visibly in it.

What changes for a mid-sized institution?

Two structural features. First, the LSI/SI split: with 1,089 less significant institutions, a German mid-sized bank is supervised by BaFin and the Bundesbank, with the ECB setting the framework rather than the questions. Second, BaFin is building proportionality into its own rulebook: the WpI-MaRisk consulted in June 2026 creates a separate, narrower, principle-based circular for small and medium-sized securities institutions, while large ones continue under the existing MaRisk. That is proportionality by document, not by discretion, which makes it more predictable to plan against.