Circular 11/2023 (VA) on Fit and Proper Requirements for Key Functions

Page 1 VAG Circular on responsible persons for key functions from 1 December 2023. Circular 11/2023 (VA) – Fit and proper assessment of the professional qualifications and good repute of individuals responsible for key functions or who carry out key functions, in accordance with the Insurance Supervision Act. Bonn, 1 December 2023 (last updated 8 May 2025)1 This circular provides explanations of the professional and personal requirements made of individuals who perform key functions (i.e. who are responsible for or act on behalf of the key function) and of the associated notification requirements based on the German Act on the Supervision of Insurance Under￾takings (Versicherungsaufsichtsgesetz – VAG). Table of Contents I. Notification requirement and necessary documents ...................................................................................... 6

1. General information about the notification requirements .............................................................. 6
2. Group of persons subject to the notification requirements ............................................................ 7 a. Organisation of a key function in an undertaking .................................................................... 7 b. Outsourcing a key function ................................................................................................................ 7 c. The concept of “intent” or “intention” ........................................................................................... 8 d. Intent of appointment at another undertaking .......................................................................... 8 e. Intent to make a new appointment due to a reorganisation ............................................... 8
3. Notification requirement upon intention of appointment .............................................................. 9 a. Information on professional qualification in the notification ............................................... 9 b. Documents required.............................................................................................................................. 9 c. The documents in detail ................................................................................................................... 10 (1) Curriculum vitae ......................................................................................................................... 10 (2) Form “Personal statement including information on fulfilling the fit and proper requirements” .............................................................................................................................. 11 1 The circular was last amended on 8 May 2025 in margin no. 26 due to removal of the notification requirement in the case of reappointments.

Page 2 VAG Circular on responsible persons for key functions from 1 December 2023. (3) “Certificate of good conduct for submission to an authority”, “European criminal record check for submission to an authority” or “corresponding documents” from abroad ....................................................................................................... 13 (a) General information on certificates of conduct ................................................... 13 (b) Specific information on certificates of conduct ................................................... 14 (4) Extract from the Central Trade and Industry Register ................................................. 15 (5) Where applicable, Proof of further training .................................................................... 17 4. Notification requirement upon resignation ........................................................................................ 17 II. Requirements for persons in positions of responsibility ............................................................................ 18

1. Professional qualifications (“fit”) .............................................................................................................. 19 a. Requirements for persons in positions of responsibility ..................................................... 19 (1) Internally responsible person ................................................................................................ 19 (2) Outsourcing manager .............................................................................................................. 20 b. Requirements for other persons .................................................................................................... 20
2. Good repute (“proper”) ............................................................................................................................... 20 a. Requirements for persons in positions of responsibility ..................................................... 20 b. Requirements for other persons .................................................................................................... 20
3. Conflicts of interest ....................................................................................................................................... 21
4. Availability in terms of time ....................................................................................................................... 21
5. Supervisory measures .................................................................................................................................. 21
6. Special attention to the requirements of the Money Laundering Act ..................................... 22 III. Outsourcing key functions ...................................................................................................................................... 22 IV. Written internal policy .............................................................................................................................................. 22

Page 3 VAG Circular on responsible persons for key functions from 1 December 2023. 1 This circular provides explanations of the professional and personal requirements made of individuals who are responsible for key functions (i.e. who are responsible for or act on behalf of the key function) and of the associated notification requirements based on the VAG of 1 April 2015 (Federal Law Gazette I, p. 434), as last amended by Article 9 of the Act of 31 May 2023 (Federal Law Gazette 2023 I no. 140). 2 The term “key functions” covers the key functions prescribed in Part 2 Chapter 1 section 3 of the VAG (subject to statutory exceptions: the independent risk control function pursuant to section 26 of the VAG, the compliance function pursuant to section 29 of the VAG, the internal audit function pursuant to sec￾tion 30 of the VAG and the actuarial function pursuant to section 31 of the VAG). In addition, the under￾takings themselves can decide whether they will have other key functions. These may be areas to be identified by the undertakings that are of significant importance for the their business operations. 3 To simplify the language, only the term “key functions” is used in the circular. All statements also refer to any additional key functions identified by the undertaking. 4 This circular is intended for all of the following types of undertaking subject to supervision by the Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht – BaFin) under the VAG – with the exception of the exclusions listed below:  insurance undertakings (section 7 no. 33 of the VAG);  Pensionsfonds (section 236 of the VAG);  insurance holding companies (section 7 no. 31 of the VAG);  undertakings within the meaning of section 293 (4) of the VAG; and  mixed financial holding companies (section 7 no. 10 of the VAG);  branches of insurance undertakings with their registered office in a third country (section 67 (2) sentence 1, also in conjunction with section 67 (4) of the VAG); (one undertaking each) in accordance with the following information. 5 The following undertakings are obliged to establish the four key functions:  insurance undertakings (with the exception of small insurance undertakings and funeral ex￾penses funds);  it also affects insurance groups consisting exclusively of domestic insurance and reinsurance undertakings and insurance groups with primary or reinsurance undertakings in other member or signatory states in accordance with section 7 no. 22 of the Insurance Supervision Act, for which the task of the authority responsible for group supervision falls to BaFin in accordance with the criteria stated in section 279 (2) of the Insurance Supervision Act (section 275 (1) sen￾tence 1 of the VAG);  branches of insurance undertakings with their registered office in a third country (section 67 (2) sentence 1, also in conjunction with section 67 (4) of the VAG). 6 Special features apply to the following undertakings:  Insurance holding companies, undertakings within the meaning of section 293 (4) of the VAG and mixed financial holding companies must set up an independent risk control function, a compliance function and an internal audit function in accordance with section 293 (1) sentence 1 of the VAG. This is without prejudice to any additional or further-reaching obligations to es￾tablish key functions in the event of additional regulation as an insurance undertaking.

Page 4 VAG Circular on responsible persons for key functions from 1 December 2023.  If the parent undertaking at the head of a financial conglomerate is subject to supervision in accordance with the VAG, an independent risk control function, a compliance function and an internal audit function must be set up in relation to the financial conglomerate in accordance with section 25 (1) of the Financial Conglomerates Supervision Act (Finanzkonglomerate￾Aufsichtsgesetz – FKAG). This is without prejudice to any additional or further-reaching obliga￾tions to establish key functions in the event of additional regulation as an insurance undertaking.  Pensionskassen must set up an independent risk control function (see section 26 (8) in conjunc￾tion with section 234c (4)) and an internal audit function (section 30 in conjunction with section 234b (2) of the VAG). This also applies in principle to the actuarial function (section 31 in con￾junction with section 234b (5) and (6) of the VAG). In contrast, a compliance function does not have to be established (section 234a (7) of the VAG).  The regulations for Pensionskassen also apply accordingly to Pensionsfonds (section 237 (1) sen￾tence 1 of the VAG). 7 The following undertakings are excluded from the scope of this circular, as there is currently no legal obligation for them to establish key functions:  small insurance undertakings pursuant to section 211 of the VAG (see section 212 (2) no. 1, (3) no. 9 of the VAG);  funeral expenses funds (section 219 (1), which refers to section 212 (2) no. 1, (3) no. 9 of the VAG);  special purpose insurance vehicles (see section 168 (2) of the VAG);  branches of insurance undertakings domiciled in another member state or EEA signatory state (section 62 (1) of the VAG). 8 In addition to the provisions of the VAG, the Commission Delegated Regulation (EU) 2015/35 and the EIOPA guidelines on system of governance (EIOPA-BoS-14/253 EN), including its Technical Annex, must also be taken into consideration by all undertakings to which this circular applies. 9 Deviations apply for company pension provision (Pensionskassen and Pensionsfonds): For these, only the relevant provisions of the of the VAG apply with regard to the requirements for the qualification of persons performing key functions. The specific characteristics of the respective business model are taken into account. 10 The reference made in section 25 (1) sentence 3 of the FKAG in conjunction with section 275 (1) sentence 3 of the VAG in conjunction with section 24 of the VAG applies to superordinated undertakings at the head of a financial conglomerate. 11 The relevant normative regulations and the contents of the circular based on them are characterised at various levels by numerous special features. At national level, different areas of law such as supervisory law, company law, labour law and worker co-determination law, as well as European provisions, must be kept in mind in parallel, some of which touch on, interfere with or modify each other. This can give rise to areas of tension that are not always amenable to a general and comprehensive solution and require a case-by-case approach. 12 The circular should be both readable and not too long, yet take the many different aspects into account. Thus the relevant special features, such as those that apply to smaller associations (section 210 of the VAG) or company pension provision (sections 232 and 236 of the VAG), must also be taken into consid￾eration, even if they are not always mentioned explicitly in the individual sections.

Page 5 VAG Circular on responsible persons for key functions from 1 December 2023. 13 This circular replaces the publication of 6 December 2018, which was previously formulated as a Guid￾ance Notice. 14 Please refer to the following circulars in the version in force at the material time with regard to BaFin’s expectations for the design of key areas of proper business organisation, these are currently:  Circular 02/2017 (VA) – Minimum Requirements under Supervisory Law on the System of Gov￾ernance of Insurance Undertakings (MaGo) incl. the corresponding FAQ published on the linked website  Circular 08/2020 (VA) – Minimum requirements under supervisory law on the system of govern￾ance of institutions for occupational retirement provision (For details of the scope of the respective “MaGo circular”, see section 2 “Scope and definitions” in each case.) 15 Section 9 of both the Minimum requirements under supervisory law on the system of governance of insurance undertakings (Mindestanforderungen an die Geschäftsorganisation von Versicherungsunterneh￾men – MaGo) and the MaGo for IORPs contains more detailed provisions on the structure of key func￾tions within their respective scopes. while section 13 (MaGo) and section 12 (MaGo for IORPs) contain more detailed specifications on outsourcing arrangements, including outsourcing key functions. Note on other publications by BaFin on related topics based on other supervisory laws In the case of thematically related publications by BaFin on the basis of supervisory laws of other financial sectors (e.g. the German Banking Act (Kreditwesengesetz – KWG)), it should be noted that, even when the content is similar, the special features of the respective supervisory area must be taken into account. This is based in particular on  European and national legal regulations, some of which differ in content;  as a result also on other guidelines issued by the relevant European supervisory authority; and  different institutional supervisory structures and their associated administrative processes. In contrast to insurance and pension funds supervision, in the area of supervision of credit institu￾tions and financial services institutions, the German Bundesbank, the European Central Bank and the auditing associations are involved in various forms in addition to BaFin. Data protection information: general information on the data processing undertaken by BaFin to comply with its statutory obligations regarding notifications of intended appointments can be found on its website www.bafin.de/EN by go￾ing to BaFin/Data protection/Information on data processing. Further information on the processing of personal data when submitting the notification of intended appointment of persons responsible for key functions can be found here.

Page 6 VAG Circular on responsible persons for key functions from 1 December 2023. I. Notification requirement and necessary documents

1. General information about the notification requirements 16 The undertaking must submit to BaFin the notifica￾tion to be made in accordance with the VAG along with the documents that must be attached. 17 Unless told otherwise, BaFin will assume that the un￾dertaking has taken the steps envisaged by the rele￾vant statutory and internal provisions and that, as far as the undertaking’s authorised representatives are aware, the person being put forward as a responsible person has, for their part, done all that is necessary (e.g. applied for a certificate of conduct and an extract from the Central Trade and Industry Register). 18 The four-digit BaFin registration number and the name of the undertaking must be entered as the ref￾erence to ensure the unambiguous assignment of a notification and the required documents. 19 The notification, as well as all documentation to be appended, must – subject to any legal exceptions – be submitted in German. If documents are not issued in German, a translation is required in addition to the foreign-language source document, subject to any legal exceptions. A certified translation or a trans￾lation prepared by a publicly appointed or sworn interpreter or translator may be required. The respon￾sible department at BaFin may – in accordance with the relevant legal provisions – refrain from requiring documents submitted in English to be translated. 20 A notification of the appointment a person in a position of responsibility (see I.2.) must be communicated without delay, which BaFin understands to mean within two weeks from the intent to appoint being formed (see I.2.c. below). 21 The curriculum vitae and the form “Personal statement including information on fulfilling the fit and proper requirements” and, if applicable, evidence of further training should be submitted to BaFin to￾gether with the notification of intent. An application for the certificate of conduct and the extract from the Central Trade and Industry Register must be submitted at the latest at the time of the notification of intent. If the extract from the Central Trade and Industry Register is already available, it must also be submitted with the notification of intent. The certificate of good conduct is sent directly to BaFin by the Federal Office of Justice. 22 The documents must not be more than three months old when the notification of intent is made. This also corresponds to the provision in Article 43(3) of Directive 2009/138/EC of 25 November 2009. The date the relevant document was issued is determinative in this case. 23 If BaFin possesses a document on the same person from a previous notification procedure and there have not been any changes and no other aspects have become relevant to the current notification pro￾cedure in the interim, then the same document can be used for additional notifications of appointment within 12 months of its issue date. 24 If reputation-related official documents were submitted to BaFin in a previous notification procedure on account of a foreign place of residence, they will not need to be resubmitted to BaFin for subsequent notifications if the foreign place of residence no longer exists and the documents hitherto submitted have an issue date that lies after the foreign place of residence came to an end. BaFin may request BaFin registration number: The registration number is a four-digit number that BaFin assigns to each undertaking for internal organisation purposes. It appears as the “ID” in the BaFin database of companies.

Page 7 VAG Circular on responsible persons for key functions from 1 December 2023. additional or updated documents and information if it appears necessary in individual cases. 25 BaFin does not bear the costs for the documents to be submitted. 2. Group of persons subject to the notification requirements 26 BaFin must be notified of the intention to appoint persons in po￾sitions of responsibility without delay. The notification must be submitted by the undertaking. If changes occur or become known at a later date with regard to the professional qualifications (fit) or repute (proper) of a person about whom a notification has already been submitted, such changes must be communicated immedi￾ately. The intention to reappoint a person in a position of respon￾sibility at the same undertaking is not subject to the notification requirement. 27 The key functions can be set up internally at the undertakings or outsourced to a service provider, whereby a natural person from the undertaking must be named as the responsible person in each case. 28 In addition to the responsible person, other persons may be work on a key function. There is no obliga￾tion to notify BaFin of these employees who support the responsible person in the fulfilment of their duties. 29 Further information on key functions and outsourcing arrangements can be found – within the scope of their respective areas of application – in the latest version, currently:  Circular 2/2017 (VA) – Minimum Requirements under Supervisory Law on the System of Gov￾ernance of Insurance Undertakings (MaGo), in particular section 9 (Key functions) and section 13 (Outsourcing);  Circular 08/2020 (VA) – Minimum requirements under supervisory law on the system of govern￾ance of institutions for occupational retirement provision (MaGo for IORPs), in particular section 9 (Key functions) and section 12 (Outsourcing). a. Organisation of a key function in an undertaking 30 When setting up a key function in the undertaking, the “Internally Responsible Person” must be notified. b. Outsourcing a key function 31 If a key function is outsourced, the relevant “outsourcing manager” will be the responsible person within the meaning of section 47 no. 1 of the VAG, and a notification will need to be submitted to BaFin about this person. The duties of the outsourcing manager in their capacity as the person responsible for a key function within the undertaking consists in supervising the work done by the service provider (see in particular margin nos. 266–273 of the MaGo as well as margin nos. 232–241 of the MaGo for IORPs). 32 The notification of the outsourcing in accordance with section 47 no. 8 of the VAG must be made sepa￾rately, with the designation of the responsible person at the service provider (see in particular margin nos. 261–265 of the MaGo and margin nos. 228–231 of the MaGo for IORPs). The competent person at the service provider is not subject to notification requirements in accordance with section 47 no. 1 of the VAG. The following table makes clear for which persons a notification must be submitted: Legal basis: Section 47 no. 1, section 67 (2) sentence 1, also in conjunction with section 67 (4), section 224 (2) sentence 4 no. 9, section 232 (1), also in conjunction with section 237 (1) sentence 1, section 275 (1) sentence 1, 293 (1) sentence 1 of the VAG

Page 8 VAG Circular on responsible persons for key functions from 1 December 2023. Notification in accordance with section 47 no. 1 of the VAG Who is to be indicated as the per￾son in the undertaking responsi￾ble for the key function? Notification in accordance with section 47 no. 8 of the VAG Who is to be named as the com￾petent person at the service pro￾vider who is responsible for the key function? Internal organisation of the key func￾tion in the undertaking “Internally responsible person” at the undertaking - Outsourcing the key function to a ser￾vice provider “Outsourcing manager” at the undertaking “Competent person” at the ser￾vice provider 33 In view of the large number of structuring options when setting up key functions, in order to check the admissibility under supervisory law it is necessary for the outsourcing company to explain the structure of its relationship with the outsourcing manager under employment, public-sector employment and, where applicable, company law (who the parties to the employment or service contract(s) are, if power of procuration (Prokura) has been granted, if there is an appointment under company law). c. The concept of “intent” or “intention” 34 The statutory provision under section 47 no. 1 of the VAG requires even the intended appointment of a responsible person to be communicated. Only a sufficiently concrete intent to appoint a responsible person is subject to notification requirements. This will be the case at the latest when the decision to appoint someone as a responsible person has been finalised by the competent governing body of the undertaking, even if the decision still requires approval by other bodies or feedback from BaFin. There must not have been an effective appointment yet. The intention to make an appointment can also be communicated at an earlier point in time if the undertaking considers the intention to make the ap￾pointment to be sufficiently concrete. 35 The notification must include the date on which the responsible person is to be appointed. d. Intent of appointment at another undertaking 36 Insofar as a responsible person is to be appointed at another undertaking while already holding a man￾date as a responsible person, all documents must be submitted in an updated form as a basic principle. Reference is made to the simplifications described under I.1. in margin numbers 23 and 24. e. Intent to make a new appointment due to a reorganisation 37 Insofar as a responsible person is to be newly appointed when an undertaking is being reorganised, a corresponding notification of intent is required. When such a new appointment takes place is deter￾mined by the provisions of reorganisation or company law. 38 No notification of intent needs to be submitted if the undertaking is changing legal form in accordance with the German Transformation Act (Umwandlungsgesetz – UmwG) and if the makeup of its persons in positions of responsibility is remaining unchanged and it will continue engaging in its insurance busi￾ness. In the event of a merger, the acquiring undertaking is required to submit a notification to the effect that a responsible person of the undertaking being acquired is to be appointed as a responsible person

Page 9 VAG Circular on responsible persons for key functions from 1 December 2023. at the acquiring undertaking. 39 If a notification of intent is necessary, all documents must be submitted in an updated form. Reference is made to the simplifications described under I.1. in margin numbers 23 and 24. 3. Notification requirement upon intention of appointment a. Information on professional qualification in the notification 40 The notification (e.g. the cover letter) must set out what professional experience, education, further train￾ing where applicable, and other qualifications possessed by the designated responsible person are deemed to constitute the appropriate theoretical and practical knowledge (i.e. is “fit”) required for their intended duties at the specific undertaking. 41 In a first step, the undertaking must – on the basis of the actual undertaking-specific criteria mentioned in section 296 (1) sentence 1 or sentence 2 of the VAG as well as the tasks and responsibilities of the position to be filled – set out which professional requirements exist for this position from the undertak￾ing’s point of view (determination of the requirement profile). 42 In a second step, the extent to which the theoretical and practical knowledge presented of the desig￾nated responsible person justifies their professional qualifications (fit) for the key functions at the un￾dertaking (illustration of how the requirement profile is fulfilled) must be clearly explained in more detail, making reference to the specific requirement profile. 43 If the designated responsible person will also have managerial responsibilities: the notification must also set out what professional experience and, if applicable, what other skills or qualifications gained by the person are deemed to constitute adequate management experience for their intended position as a responsible person. To this end, information must be provided on the management competence re￾quired for the future position and the person’s previous management experience (in particular what internal decisions the person had the authority to make, what business areas they were previously re￾sponsible for, including the number of employees) and these must be set in relation to each other (com￾parability of the management range/management tasks). Reference is made to the rebuttable presump￾tion in section 24 (1) sentence 4 of the VAG. 44 BaFin expects a specific description of the requirement profile of the position to be filled, including a detailed explanation of why the envisaged responsible person fulfils this requirement profile. 45 In isolated cases in the past, BaFin was unable or initially unable to fully understand descriptions pro￾vided by undertakings regarding the professional qualifications (fit) of certain designated responsible persons. This particularly related to people who had not previously worked in the insurance industry or for whom the intended position was accompanied by a large increase in the management range. BaFin therefore expects a more detailed presentation in such cases. The statements provided by undertakings enable BaFin to assess whether the designated responsible person will have the necessary professional qualifications (fit) for the position at the time they are expected to begin the function or – insofar as they are not (yet) deemed fit on the basis of the supervisory inspection – whether additional qualifications such as a familiarisation period combined with a later start date are required. b. Documents required 46 The notification of intent must be accompanied by the following documents:

Page 10 VAG Circular on responsible persons for key functions from 1 December 2023. (1) Curriculum vitae of the designated responsible person (2) The form “Personal statement including information on fulfilling the fit and proper requirements” from the responsible person (3) A “Certificate of good conduct for submission to an authority”, “European criminal records check for submission to an authority” and/or “corresponding documents” from abroad (4) An extract from the Central Trade and Industry Register (5) Where applicable, proof of further training (6) In the cover letter or as a separate document: a specific description of the requirement profile of the position to be filled, including a detailed explanation of why the intended person fulfils this requirement profile (see I.3.a) above) 47 Please note: Certificates of conduct are sent directly to BaFin by the Federal Office of Justice. 48 BaFin provides a checklist on its website as an appendix to this circular, which the notifying undertaking can use to make sure they are enclosing all the necessary documents. 49 General guidance notes on communicating with the Insurance Supervision can be found on the BaFin website, currently here. 50 As soon as an electronic submission procedure for notifications and change notifications has been es￾tablished, notifications and change notifications (each including the documents to be submitted to BaFin by the undertaking) must be submitted via this procedure. BaFin will publish further details on its website in due course. c. The documents in detail (1) Curriculum vitae 51 The notification of intent must be accompanied by a detailed CV. The CV of the designated responsible person must be dated, without gaps, complete and truthful. Signing it with an electronic facsimile (scanned-in signature) is currently2 sufficient as a basic principle. The CV must include the following information:  surname, all first names, birth name if applicable, in￾terim names;  date of birth, place of birth;  place(s) of residence;  citizenship(s);  a detailed description of the candidate’s professional background;  the names of all undertakings for which the person works or has worked; 2 Reference is made to the Guidance notes on communicating with the Insurance Supervision Sector in all other respects. As soon as a standardised electronic submission procedure for notifications and change notifications has been established, noti￾fications and change notifications (each including the documents to be submitted to BaFin by the undertaking) must be submit￾ted via this procedure. BaFin will publish further details on its website in due course. See the Technical Annex to the EIOPA guidelines on system of governance The European regulations contain detailed specifications on what in￾formation must be provided to the supervisory authority.

Page 11 VAG Circular on responsible persons for key functions from 1 December 2023.  information on the type and duration of the respective jobs, including secondary activities;  details concerning language skills. 52 The focus of the CV must be on the stages of the candidate’s professional life. The individual career stages include in particular:  the specific position;  start and end of activity with month and year in each case;  the name and registered office of the undertaking (for supervised undertakings include the register number) as well as the type and scope of the business model (e.g. regionally active hail insurer, nationally active health insurer, internationally active reinsurer);  the location of the job. 53 If the person has been resident outside Germany in the past ten years, the relevant country and period of time must be indicated. The CV must also state if the principal residence and the place of professional activity were not in the same country. This information will be relevant for BaFin insofar as it has an impact on the register extracts to be submitted (see I.3.c. (3) and (4) below). (2) Form “Personal statement including information on fulfilling the fit and proper requirements” 54 BaFin makes the “Personal statement including information on fulfilling the fit and proper requirements” form available on its website for the declarations to be made by those intended to become persons responsible for key functions at an undertaking:  disclosure of criminal convictions and administrative offence proceedings;  sovereign sanctions;3  proceedings under commercial or property law and proceedings concerning the withdrawal or revocation of a licence to practise as a liberal professional if the proceedings in question could be relevant to determining whether or not the person is of good repute (proper) (e.g. section 35 of the German Trade Regulation Code (Gewerbeordnung – GewO), insolvency pro￾ceedings, proceedings regarding the swearing of an affidavit regarding financial circum￾stances, section 46 of the German Tax Advisory Act (Steuerberatungsgesetz – StBerG), section 20 of the German Act on the Profession of Auditors (Wirtschaftsprüferordnung – WPO) or section 14 of the German Federal Lawyers’ Act (Bundesrechtsanwaltsordnung – BRAO));  disclosure of relationships;  disclosure of business relationships;  disclosure of qualifying holdings within the meaning of section 7 no. 3 of the VAG;  overview of further mandates. 55 The form must be dated and then submitted both together with the notification of intent and, in updated form, in the event of any changes occurring at a later date. Signing it with an electronic facsimile 3 “Sovereign sanctions” include the cases set out in section 7a of the VAG, which result in the person not being considered of good repute (proper) (sentence 1) or generally result in the person not being considered of good repute (proper) (sentences 2 and 3). Similar matters under other legal systems must also be disclosed, which also includes sovereign sanctions imposed by official bodies outside the European Union.

Page 12 VAG Circular on responsible persons for key functions from 1 December 2023. (scanned-in signature) is currently4 sufficient as a basic principle. 56 Pending criminal proceedings may be disregarded in the disclosure  if they were discontinued due to lack of sufficient suspicion;  if they were discontinued due to a permanent impediment to proceedings;  if they ended with an acquittal;  if an entry made in the Federal Central Criminal Register (Bundeszentralregister – BZR) re￾garding them is to be removed or cancelled; or  if they do not have to be stated in accordance with section 53 of the Federal Central Criminal Register Act (Bundeszentralregistergesetz – BZRG). 57 Criminal proceedings discontinued in accordance with sections 153 and 153a of the Code of Criminal Procedure (StPO) and other (provisionally) discontinued criminal proceedings – with the exception of discontinuations in accordance with section 170 (2) of the StPO – must be disclosed, as such proceedings may also give rise to indications that the person is not of good repute (proper), particularly in the case of proceedings in connection with infringements that are punishable by law against relevant supervisory law, property or insolvency offences or tax offences. However, these proceedings do not have to be disclosed if they were concluded with a fine, condition, instruction or other decision more than five years before the beginning of the year in which the notification is submitted. 58 Furthermore, any administrative fines or other administrative proceedings relevant to the Central Trade and Industry Register that were pending at the time of the disclosure may be disregarded  if they were discontinued due to lack of sufficient suspicion;  if they were discontinued due to a permanent impediment to proceedings;  if they ended with an acquittal;  if they are to be removed from the Central Trade and Industry Register or cancelled in ac￾cordance with sections 152 and 153 of the GewO;  with regard to decisions to withdraw or revoke the licence to practise as a liberal profes￾sional if the reason for the withdrawal or revocation ceased to exist more than five years ago; or  if the person concerned has been exonerated of the accusation in the relevant administra￾tive proceedings. 59 Similar matters with regard to criminal procedures, administrative fines and other administrative proce￾dures under other legal systems must also be disclosed. 60 The information must be complete and correct. If proceedings are to be indicated, copies of judgements, decisions, notices or other relevant documents must be attached. BaFin reserves the right to obtain further information from the competent authorities if necessary. 4 Reference is made to the Guidance notes on communicating with the Insurance Supervision Sector in all other respects. As soon as a standardised electronic submission procedure for notifications and change notifications has been established, noti￾fications and change notifications (each including the documents to be submitted to BaFin by the undertaking) must be submit￾ted via this procedure. BaFin will publish further details on its website in due course.

Page 13 VAG Circular on responsible persons for key functions from 1 December 2023. 61 It is advisable to contact the division responsible at BaFin in the event of any doubt. In order to assess any conflicts of interest, the person must also dis￾close any relationships with the members of senior management and the members of the administrative or supervisory board. In addition, information must be provided on qualifying holdings within the mean￾ing of section 7 no. 3 of the VAG of the person and of their relatives within the meaning of section 11 (1) no. 1 of the German Criminal Code (Strafgesetzbuch – StGB) in the undertaking itself and other undertak￾ings that hold shares in the undertaking. 62 Insofar as (i) the person, (ii) a relative within the meaning of section 11 (1) no. 1 of theStGB, or (iii) another undertaking managed by the person or their relative within the meaning of section 11 (1) no. 1 of the StGB maintains business relationships with the undertaking submitting the notification that could make that undertaking economically dependent on the reporting undertaking, the nature and extent of the relationships must be described. Holding 10% or more of the capital or voting rights in another under￾taking or having any other possibility of exercising a significant influence over the management of this other undertaking is equivalent to managing another undertaking (based on section 7 no. 3 of the VAG). (3) “Certificate of good conduct for submission to an authority”, “European criminal record check for submission to an authority” or “corresponding documents” from abroad (a) General information on certificates of conduct 63 Depending on their citizenship and place of resi￾dence, the responsible person may need to submit a Certificate of good conduct for submission to an au￾thority (document type “O”) issued by the Federal Of￾fice of Justice in accordance with section 30 (5) of the Federal Central Register Act (Bundeszentralregisterg￾esetz – BZRG) (a certificate of conduct), a European certificate of conduct for submission to an authority in accordance with section 30 (5) and section 30b of the BZRG (a “European criminal record check”) and/or corresponding certificates of conduct or dec￾larations regarding assessments of reputation con￾ducted by supervisory authorities in their country of residence in consultation with the relevant division at BaFin (“corresponding documents”).5 5 The Federal Office of Justice sends the (European) certificate of conduct directly to BaFin. In contrast, the undertaking must provide BaFin with the relevant documents from abroad – as well as the extract from the Central Trade and Industry Register. The Guidance notes on communicating with the Insurance Supervision Sector apply at present. As soon as a standardised elec￾tronic submission procedure for notifications and change notifications has been established, notifications and change notifica￾tions (each including the documents to be submitted to BaFin by the undertaking) must be submitted via this procedure. BaFin will publish further details on its website in due course. Relatives within the meaning of section 11 (1) no. 1 of the StGB: a) Relatives and in-laws in the direct line, the spouse, civil partner, fiancé(e), siblings, spouses or civil partners of siblings, siblings of spouses or civil partners, even if the marriage or civil partnership that established the relationship is no longer in ef￾fect or if the relationship or in-law relationship has lapsed; b) Foster parents and foster children. Federal Central Criminal Register (BZR) The Federal Office of Justice maintains the Federal Central Criminal Register, the details of which are regulated in the BZRG. Criminal convictions, deci￾sions by administrative authorities and courts, notes of incapacity and insanity by German courts and authorities are entered in this register. The entries are removed under the conditions set out in the BZRG. Anyone can apply for a certificate of good conduct pertaining to themselves, and un￾der certain conditions authorities can also request information.

Page 14 VAG Circular on responsible persons for key functions from 1 December 2023. 64 Responsible persons who have lived in several countries in the past ten years are required to provide certificates of conduct and corresponding documents from each country. Any legal obstacles to submis￾sion must be explained to the relevant department at BaFin. 65 In countries where a certificate of conduct is issued by a public sector entity, it may not be replaced by other documents. 66 The certificate of good conduct should not be confused with the “enhanced certificate of conduct” (ex￾tended criminal records check) in accordance with section 30a of the BZRG. 67 The application for a certificate of con￾duct and a European criminal record check must be submitted by the per￾son themselves, either in person to the local registration office (section 30 (2) sentence 1 of the BZRG) or electroni￾cally to the Federal Office of Justice (section 30c of the BZRG). German na￾tionals residing outside the Federal Re￾public of Germany can submit the ap￾plication directly to the Federal Office of Justice as the registration authority (section 30 (3) sentence 1 of the BZRG). The application must be submitted to the Federal Office of Justice in good time so that BaFin receives the certificate of good conduct or the European criminal record check in a timely manner, together with the undertaking’s notification. 68 The four-digit BaFin registration number and the name of the undertaking must be entered as the reference to ensure that BaFin can allocate the certificates of good conduct received to the undertaking at which the person in question is to be appointed. The Federal Office of Justice sends both the certificate of conduct and the European certificate of con￾duct directly to BaFin. (b) Specific information on certificates of conduct 69 Specifically, the following certificates of conduct and, if applicable, corresponding documents must be submitted: Persons with... Documents German nationality and... their place of residence in Ger￾many A certificate of good conduct issued by the Federal Office of Justice their place of residence in a Member State of the European Union or a third country A certificate of good conduct issued by the Federal Office of Justice and the “corresponding docu￾ments” from the country of residence their place of residence in Ger￾many A European certificate of good conduct issued by the Federal Office of Justice European certificate of good conduct Since 27 April 2012, it has been possible to apply for a European certificate of good conduct after the German legislator applied section 30b of the BZRG (which was last amended by Article 1 of the Act of 4 December 2022 (Federal Law Gazette I p. 2146)) to implement the provisions of Council Framework Decision 2009/315/JHA of 26 February 2009, on the organisation and con￾tent of the exchange of information extracted from the criminal records of different Member States (OJ L 93 from 7 April 2009, p. 23). The Federal Office of Justice has published explanatory notes on the European certificate of good conduct on its website.

Page 15 VAG Circular on responsible persons for key functions from 1 December 2023. Persons with... Documents the citizenship of another Member State of the Euro￾pean Union and... their place of residence in a Member State of the European Union or a third country “Corresponding documents” from the country of residence the citizenship of a third country and... their place of residence in Ger￾many A European certificate of good conduct issued by the Federal Office of Justice their place of residence in a Member State of the European Union or a third country “Corresponding documents” from the country of residence (4) Extract from the Central Trade and Industry Register 70 An extract from the Central Trade and Industry Register in accordance with section 150 of the GewO must also be submitted to BaFin.6 71 The application for an extract from the Central Trade and Industry Register must be submitted by the person themselves, either in person to the competent local authority – usually the registration office or Trade Supervisory Office (Gewerbeaufsichtsamt) – (sections 150 (2) and 155 (2) of the GewO in conjunc￾tion with the relevant provisions of individual state legislation) or electronically to the Federal Office of Justice (section 150e of the GewO). Persons residing outside the Federal Republic of Germany can submit the application directly to the Federal Office of Justice in its capacity as the registration authority (section 150 (3) of the GewO). It is important to ensure that a natural person applies for the register extract. 6 The Federal Office of Justice sends the (European) certificate of conduct directly to BaFin. In contrast, the undertaking must provide BaFin with the relevant documents from abroad – as well as the extract from the Central Trade and Industry Register. The Guidance notes on communicating with the Insurance Supervision Sector apply at present. As soon as a standardised elec￾tronic submission procedure for notifications and change notifications has been established, notifications and change notifica￾tions (each including the documents to be submitted to BaFin by the undertaking) must be submitted via this procedure. BaFin will publish further details on its website in due course.

Page 16 VAG Circular on responsible persons for key functions from 1 December 2023. 72 The following instructions on completion of the official form GZR 3 in the German Second general administrative regulation on fulfilment of section XI – Central Trade and Industry Register – of the Trade Regulation Code (Zweite allgemeine Verwaltungsvorschrift zur Durchführung des Titels XI – Gewerbezentralregister – der Gewerbeordnung – 2. GZRVwV – Ausfüllanleitung) of 29 July 1985 must be complied with:  Code “1” must be entered in field 01, “Docu￾ment type”.  Both boxes in field 20 are to be left blank. 73 The four-digit BaFin registration number and the name of the undertaking must be entered as the reference to en￾sure that BaFin can allocate any extracts from the Central Trade and Industry Register that it might receive separately to the undertaking at which the person in question is to be appointed. 74 In accordance with the provisions of the GewO, the Federal Office of Justice sends the extract from the Central Trade and Industry Register to the applicant rather than directly to BaFin. As soon as it has been received, an extract must be submitted to BaFin together with the other documents to be enclosed with the notification of intent. However, a later submission is also possible. 75 As a basic principle, BaFin waives the requirements to submit an extract from the (German) Central Trade and Industry Register and provide comparable foreign documents for persons who have not yet resided or worked in Germany. BaFin reserves the right to request further documents in individual cases. Application of the provisions on the Central Trade and Industry Register to undertakings subject to su￾pervision under the VAG The provisions of sections 149 et seq. of the GewO governing the Central Trade and Industry Register also apply to undertakings and to natural persons working for them (see section 6 (1) sentence 3 of the GewO). The requirement to use the Central Trade and Industry Register for insurance undertakings is also based on the Second General Administrative Regulation on Fulfilment of Section XI – Central Trade and Industry Register – of the GewO (2 nd General Administrative Regulation – instructions for completion –) of 29 July 1985, which was issued by the then Federal Ministry of Justice in agreement with the then Federal Ministry for Economic Affairs in accordance with section 153b sentence 1 of the GewO (old version; now section 153c of the GewO). The first part, “Notifications”, contains the formal requirements for the entities subject to notification requirements that prepare notifications concerning the Central Trade and Industry Register in accordance with section 153a (1) sentence 1 of the GewO. The forms GZR 1 and GZR 2 (Appendix 1 to the 2nd GZRVwV) contain the field 23 “Trade code”; in accordance with no. 1.26 and no. 3.10 of the 2nd GZRVwV, a four-digit code must be entered here based on Appendix 4 to the 2nd GZRVwV, “List of codes of trades and commercial enterprises”. The following insurance lines are listed in “Part 6: Credit institutions and the insurance industry” under the serial numbers 146– 149: Serial no. Name of the trade Code 146 Life insurance, Pensionskassen and funeral expenses funds 6100 147 Health insurance 6120 Central Trade and Industry Register The Federal Office of Justice maintains a Central Trade and Industry Register, the de￾tails of which are stipulated in sections 149 et seq. of the GewO. Administrative deci￾sions, fines and criminal convictions in con￾nection with commercial activities are en￾tered in the register. These include the rev￾ocation of a business licence because the person proved not to be of good repute (proper), fines for a tax offence or convic￾tions under the German Act to Combat Ille￾gal Employment (Schwarzarbeitsbekämp￾fungsgesetz – SchwarzArbG). The entries are cancelled/removed under the condi￾tions set out in the GewO. Anyone can ap￾ply for an extract from the register pertain￾ing to themselves, and under certain con￾ditions authorities can also request infor￾mation.

Page 17 VAG Circular on responsible persons for key functions from 1 December 2023. 148 Property and casualty insurance 6140 149 Reinsurance 6160 150 Brokering of insurance policies 6190 (5) Where applicable, Proof of further training 76 If the professional qualifications (fit) of a responsible person were (also) obtained by completing further training courses, then corresponding proof (photocopies will suffice as a basic principle) of successful participation in the further training must be enclosed with the notification of intent. The proof must indicate the organiser, the content and the duration of the training course(s). The requirement to submit evidence only relates to further training that is relevant for the assessment of the existence of the pro￾fessional qualification required in accordance with section 24 (1) of the VAG. 4. Notification requirement upon resignation 77 The undertaking is required to communicate the resig￾nation of a responsible person without delay, giving the reasons in each case insofar as these are relevant to an assessment of the person’s suitability (section 24 (1) of the VAG). 78 Rather than being submitted together with a notification of appointment, the notification of resignation must be sent separately so that the two processes can be kept clearly separate for data protection purposes. Legal basis: Section 47 no. 2, 67 (2) sentence 1, also in conjunction with section 67 (4), section 224 (2) sentence 4 no. 9, section 232 (1), also in conjunction with section 237 (1) sentence 1, section 275 (1) sentence 1, 293 (1) sentence 1 of the VAG

Page 18 VAG Circular on responsible persons for key functions from 1 December 2023. II. Requirements for persons in positions of responsibility 79 The responsible person must be professionally qualified (“fit”) and of good repute (“proper”). Professional qualifications (fit) must be up to date. 80 In the case of institutions for occupational retirement provision, only the relevant provisions of the of the VAG are to be applied and the corresponding special features under supervisory law are to be observed (in particular sections 234a (7), 234b of the VAG and section 9 of the MaGo for IORPs). With regard to the require￾ments for responsible persons, particular attention is paid to the business model, including the nature, scale and complexity of the risks facing the undertaking in question based on the provisions of the VAG (section 296 (1) sentence 1 of the VAG). In the case of Pensionskassen and Pensionsfonds, the specific characteristics of pension provision funds are taken into account (section 296 (1) sentence 2, also in conjunction with section 237 (1) sentence 1 of the VAG). The provisions of the Commission Delegated Regulation (EU) and the EIOPA guidelines are not to be applied to these undertakings. 81 The principle of proportionality plays a major role, in particular when implementing the requirements for professional qualifications (“fit”). Thus, the principle of proportionality is associated with the indi￾vidual characteristics of the criteria specified in section 296 (1) sentence 1 or sentence 2 of the VAG for the respective undertaking. 82 As it thus depends on the undertaking-specific characteristics of the criteria specified in section 296 (1) sentence 1 or sentence 2 of the VAG, a case-by-case assessment is always required. However, an assess￾ment of which form may be regarded as proportionate is not set in stone, including with regard to the individual undertaking. Rather than being done once only, the assessment must be carried out whenever a notification of intent is received on the basis of the current characteristics of the criteria of the respec￾tive undertaking specified in section 296 (1) sentence 1 or sentence 2 of the VAG. In this respect, the undertakings have to examine whether and how the available structures and processes must be further developed. 83 Proportionality has nothing to do with whether or not the applicable requirements need to be complied with. It only affects the manner in which the requirements can be fulfilled. While less stringent require￾ments are possible for undertakings with a lower level of the criteria specified in section 296 (1) sentence 1 or sentence 2 of the VAG, undertakings with a higher level of these criteria may only be able to classify more complex structures as proportional under certain circumstances. 84 The requirements that the person be of good repute (“proper”) reflect the same standards, as their reputation and integrity must always be ensured to the same degree regardless of the individual char￾acteristics of the criteria specified in section 296 (1) sentence 1 or sentence 2 of the VAG. 85 Whether a person is deemed to have the professional qualifications (fit) and good reputation (proper) is assessed based on the documents submitted. The criteria required by law must nevertheless be met not only at the time of appointment, but also throughout the entire time the responsible person exer￾cises the mandate. 86 In the case of management positions, the existence of corresponding management experience should Legal basis: Section 24 (1), 67 (2) sentence 1, also in conjunction with section 67 (4), section 224 (2) sentence 4 no. 2, section 232 (1), 234b (7), also in conjunction with section 237 (1) sentence 1, section 275 (1) sen￾tence 1, section 293 (1 ) sen￾tence 1 of the VAG Article 273 (2), (3) of the Commis￾sion Delegated Regulation (EU)

Page 19 VAG Circular on responsible persons for key functions from 1 December 2023. also be taken into account.

1. Professional qualifications (“fit”) 87 Having the professional qualifications means that respon￾sible persons are able (fit) to fulfil their position in the key function at all times based on their professional qualifica￾tions, knowledge and experience. 88 Having the professional qualifications requires in particu￾lar continuing development, so that the persons in posi￾tions of responsibility are able to fulfil changing or in￾creasing requirements made of their duties at their un￾dertaking. As a bare minimum, the undertakings must re￾assess the suitability of the relevant persons on the occa￾sions specified in no. 13 of the EIOPA guidelines on the system of governance (EIOPA-BoS-14/253 EN). a. Requirements for persons in positions of responsibility 89 The professional qualifications (fit) required of persons responsible for a key function are derived from the descriptions of their respective responsibilities within the governance system:  section 26 of the VAG and Art. 269 of the Commission Delegated Regulation (EU): the inde￾pendent risk management function;  section 29 of the VAG and Art. 270 of the Commission Delegated Regulation (EU): the com￾pliance function;  section 30 of the VAG and Art. 271 of the Commission Delegated Regulation (EU): the inter￾nal audit function;  section 31 of the VAG and Art. 272 of the Commission Delegated Regulation (EU): the actu￾arial function. 90 In accordance with section 31 (3) of the VAG, the actuarial function must have knowledge of insurance and financial mathematics appropriate to the nature, scope and complexity of the undertaking’s risks, as well as relevant experience with the essential professional (and other) standards. 91 In the case of institutions for occupational retirement provision, the relevant special features of supervi￾sory law must be observed (in particular sections 234a (7), 234b of the VAG and no application of Articles 269 to 272 of the Commission Delegated Regulation (EU)). 92 Furthermore, reference is made to the more detailed requirements for the organisation of key functions and corresponding outsourcing in the MaGo (sections 9 and 13) and MaGo for IORPs (sections 9 and 12). (1) Internally responsible person 93 When setting up the key function in the undertaking, the internally responsible person must have the necessary knowledge to perform the key function. Legal basis: Section 24 (1) of the VAG; Article 273 of the Commission Delegated Regulation (EU) In accordance with Article 273(1) of the Commission Delegated Regulation (EU), undertakings must ensure that all persons in positions of responsibility possess the necessary professional qualifications (fit) and are of good repute (proper) at all times.

Page 20 VAG Circular on responsible persons for key functions from 1 December 2023. (2) Outsourcing manager 94 The professional qualifications required of an outsourcing manager depend on which key function is being outsourced. The outsourcing manager must monitor the work of the external service provider or sub-service provider. The outsourcing manager must have sufficient knowledge of the outsourced key function in order to fulfil their monitoring function. b. Requirements for other persons 95 The professional qualifications required of persons working for key functions depend on their respective responsibilities, activities and competences. 96 If the undertaking provides deputies for responsible persons, these must also be appropriately qualified. The deputy is not subject to notification requirements. A notification requirement only arises when the previous responsible person leaves the position and the deputy becomes the responsible person on a permanent basis. 2. Good repute (“proper”) a. Requirements for persons in positions of responsibility 97 Responsible persons must be of good repute (“proper”). It is not necessary to furnish positive proof that the person is of good repute (proper). This means that the person is considered to be of good repute if no facts are evident that would justify considering them not of good repute. 98 A person is to be deemed not of good repute if personal circumstances based on general life experience justify the assumption that these circumstances may make it harder for them to work reliably and properly as a responsible person. This must take into account the responsible person’s personal behav￾iour and business conduct in financial terms and under criminal, property and supervisory law. Criminal or administrative offences – especially those in connection with activities at undertakings – are of par￾ticular relevance within both the German and foreign legal systems. 99 Not being of good repute does not assume the person is at fault. 100 If relevant circumstances arise or have arisen, BaFin will determine on a case-by-case basis whether the responsible person is not or is no longer to be deemed of good repute (“proper”) with regard to the performance of their duties. 101 Criteria for not being of good repute (proper) include:  supervisory measures that BaFin is taking or has taken against the person or an undertaking in which the person serves or has served as a member of senior management or member of an administrative or supervisory body;  property- or tax-related criminal or administrative offences, money laundering offences or serious crime;  conflicts of interest. b. Requirements for other persons 102 The persons responsible for key functions must also be of good repute (“proper”).

Page 21 VAG Circular on responsible persons for key functions from 1 December 2023. 3. Conflicts of interest 103 Conflicts of interest exist if a responsible person’s personal circum￾stances or their own economic activity are likely to compromise the in￾dependence of their work and their duty to act in the undertaking’s best interests. Permanent conflicts of interest prevent a person from pursuing their work. 104 A conflict of interest can consist in a responsible person being related to one or more of the following persons at the undertaking submitting the notification or at its parent company or subsidiary:  member of senior management;  members of the administrative or supervisory body; or  persons responsible for key functions. 105 Whether a relationship prevents the person from performing their work must be determined on a case￾by-case basis. 106 A conflict of interest can also exist if (i) the responsible person, (ii) a relative (section 11 (1) no. 1 of the StGB) of the responsible person, or (iii) another undertaking managed by the responsible person or their relative maintains business relationships with the undertaking submitting the notification that could make that undertaking economically dependent. Holding 10% or more of the capital or voting rights in another undertaking or having any other possibility of exercising a significant influence over the man￾agement of this other undertaking is equivalent to managing another undertaking (based on section 7 no. 3 of the VAG). 107 Conflicts of interest affecting the responsible person, especially any connected with their own economic activity (e.g. if they are also working as a broker) may be relevant to assessing whether they are of good repute (proper). 108 Reference is also made in particular to the MaGo and the MaGo for IORPs that contain additional guid￾ance notes on conflicts of interest affecting key functions within their respective scopes. 109 Responsible persons should disclose potential conflicts of interest at least to the chair of the manage￾ment board at an early stage. The management board is required to record in an appropriate manner the conflicts of interest affecting the person and how these conflicts are to be handled. 4. Availability in terms of time 110 Responsible persons must devote sufficient time to their work. This means that the persons in positions of responsibility must generally be able to dedicate sufficient time to their duties, taking into account their professional and social obligations, and also that they actually do spend the requisite time on them. As a basic principle, it is the responsibility of each individual responsible person to only accept an activity if they will be able to devote the necessary time to it. 5. Supervisory measures 111 Violations of the regulations and orders specified in section 303 of the VAG (in addition to the standards of the VAG and the Delegated Regulation (EU), these also include, e.g., those for the prevention and Legal basis: Section 24 (1) of the VAG; Article 258(5), 268(1) of the Commission Delegated Regulation (EU)

Page 22 VAG Circular on responsible persons for key functions from 1 December 2023. combating of money laundering and terrorist financing) can – in addition to other supervisory measures – lead to warnings, dismissal requests and activity bans under the conditions specified there. 6. Special attention to the requirements of the Money Laundering Act 112 Certain insurance undertakings are obliged entities within the meaning of the German Money Launder￾ing Act (Geldwäschegesetz – GwG). These include, pursuant to section 2 (1) no. 7 of the GwG, Solvency II insurance undertakings and domestic establishments of such undertakings with their registered office abroad, in each case in accordance with lit. a) to d). These obliged entities must comply with the require￾ments standardised in the GwG and in sections 52 to 55 of the VAG. BaFin has published the Interpreta￾tion and Application Guidance on the German Money Laundering Act as well as a special section for insurance undertakings (Auslegungs- und Anwendungshinweise zum Geldwäschegesetz – Besonderer Teil für Versicherungsunternehmen – AuA BT VU) on its website. III. Outsourcing key functions 113 When outsourcing key functions to a service provider or sub-service provider, undertakings must ensure that the persons at the service provider or sub-service provider who are responsible for the key functions are sufficiently qualified (section 234b (7) of the VAG applies to company pension provision in this re￾spect). The service provider or sub-service provider must present its own audit process and provide the undertaking with written confirmation of the results of the process audit. 114 The undertakings must each appoint an outsourcing officer who bears operational responsibility for the proper implementation of the mandate of the key function. The ultimate responsibility also lies with the management board in the event of outsourcing. 115 These requirements also apply in the case of outsourcing within the enterprise or group. 116 Persons at the service provider or sub-service provider who are responsible for key functions are not subject to the notification requirement to BaFin. 117 However, the competent persons at the service provider must be named as part of the separate notifi￾cation requirement for the intention to outsource a key function in accordance with section 47 (8) of the VAG. For further details on outsourcing key functions, please refer to the MaGo and MaGo for IORPs circulars, in particular the corresponding sections on outsourcing (section 13 in the MaGo, section 12 in the MaGo for IORPs). IV. Written internal policy 118 Undertakings – apart from pension provision funds – must have written in￾ternal guidelines in place that set out responsibilities and the procedures for assessing the professional qualifications (fit) and good repute (proper) of the persons that are responsible for or active in key functions. Among other things, these must record which documents the undertaking uses to ensure that the requirements specified here are complied with. 119 The written internal guidelines must be regularly reviewed and, if necessary, adapted to current devel￾opments in the undertaking. Legal basis: Section 23 (3) of the VAG Article 273(1) of the

Page 23 VAG Circular on responsible persons for key functions from 1 December 2023. 120 Reference is also made to Guideline 13 of the EIOPA guidelines on the governance system.