Circular on the Members of the Management Body and of Administrative and Supervisory Bodies in accordance with the German Banking Act

„This translation is furnished for information purposes only. The original German text is binding in all respects.“ Circular 11/2025 on the members of the management body and of administrative and supervisory bodies in accordance with the German Banking Act Bonn, 22 October 2024 This Circular is based on the Guidance Notices dated 29 December 2020 and consolidates them to avoid duplication. To the extent that the requirements for members of the management body and members of the administrative and supervisory bodies differ, this is explicitly indicated in the headings. The joint guidelines of the European Banking Authority EBA) and the European Securities and Markets Authority (ESMA) “Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders“ (EBA/GL/2021/06) and the EBA’s “Guidelines on internal governance” (EBA/GL/2021/05) were incorporated to the extent that BaFin has adopted them in its administrative practice. As set out in Title I of the Guidelines, the principle of proportionality applies. The Circular is limited to the scope of application of the German Banking Act (Gesetz über das Kreditwesen – KWG) and is addressed to its target users. This Circular does not apply to qualified crypto custodians under the KWG, to the extent that they are also subject to the MiCAR. European requirements, guidelines and supervisory standards take precedence in this regard. Conversely, it applies in principle to KWG institutions to the extent that they engage in qualified crypto custody business in accordance with section 1 (1a) sentence 2 no. 6 of the KWG, maintenance of crypto securities registers in accordance with section 1 (1a) sentence 2 no. 8 of the KWG, or both. These institutions are subject in particular to the principle of proportionality, which aims to give appropriate consideration to operational (size, structure, complexity of business model) and risk-specific factors. Business- and sector-specific factors must also be taken into account.

Page 2 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act Table of contents 1 Requirements ..................................................................................................................... 5 I. Notification requirement and necessary documents .......................................................... 5

1. General guidance on the notification requirements............................................................ 5
2. Persons and matters go be notified ........................................................................................... 7
3. Timing of the notification requirement .................................................................................... 8 a. In the case of an intention to appoint members of a management body .................... 8 b. In the case of appointment of members of an administrative or supervisory body .. 8
4. Necessary documents ..................................................................................................................... 8 a. CV .............................................................................................................................................................. 9 b. Information on reliability ................................................................................................................ 10 c. “Certificate of good conduct for submission to an authority”, “European certificate of good conduct for submission to an authority” or “corresponding documents” from abroad ...................................................................................................................................... 11 (1) General guidance on official certificates of good conduct ......................................... 11 (2) Specific guidance on official certificates of good conduct ......................................... 12 d. Extract from the Central Trade and Industry Register .......................................................... 13 e. Overview of other mandates as a member of a management body and of administrative or supervisory bodies ...................................................................................... 14 f. Information on availability ............................................................................................................. 15
5. Notification of completed appointment of a member of a management body .... 15
6. Notification requirement in the event of termination ...................................................... 15
7. Personal disclosure obligations – other activities of a member of a governing body 16
8. Notification of new facts .............................................................................................................. 16
9. Administrative fines for breach of notification obligations ............................................ 17 II. Requirements for members of governing bodies .............................................................. 17
10. Theoretical and practical knowledge ....................................................................................... 17 a. Professional qualifications of members of a management body .................................... 17 (1) Theoretical knowledge .............................................................................................................. 18 (2) Practical knowledge ................................................................................................................... 19 (3) Management experience.......................................................................................................... 19 (4) Collective professional qualifications .................................................................................. 19 (5) Onboarding and continuing professional development .............................................. 20 b. Expertise of the members of an administrative or supervisory body ............................ 20

Page 3 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act (1) Requirements for individual expertise ................................................................................ 20 (a) Representatives in administrative or supervisory bodies subject to co￾determination requirements ........................................................................................... 21 (b) Members by virtue of their office ..................................................................................... 21 (c) Continuing professional development ........................................................................... 21 (d) Onboarding and continuing professional development ......................................... 22 (2) Requirements for the knowledge, skills and experience of the administrative or supervisory body collectively, including accounting/auditing................................. 23 2. Reliability ............................................................................................................................................ 23 a. Conflicts of interest ........................................................................................................................... 24 b. Independence of mind .................................................................................................................... 26 3. Availability .......................................................................................................................................... 26 4. Mandate restrictions ...................................................................................................................... 27 a. Former management board members in administrative and supervisory bodies .... 27 b. Strict mandate restrictions (section 25c (2) and section 25d (3) of the KWG) ............ 28 (1) Other management and supervisory mandates .............................................................. 29 (a) Multiple mandates counted as a single mandate ...................................................... 29 (b) Mandates at organisations and undertakings that do not pursue predominantly commercial objectives ........................................................................ 31 (c) Mandates of senior municipal administrative officers ............................................. 32 (d) Mandates as representatives of the federal government or state governments .................................................................................................................................................... 33 (2) Authorisation of an additional mandate ............................................................................ 34 c. Simple mandate restrictions .......................................................................................................... 34 d. Legacy mandate grandfathering .................................................................................................. 35 5. Administrative fines ........................................................................................................................ 35 III. General obligations of members of governing bodies – policies and processes ... 35

1. Suitability policies ........................................................................................................................... 36
2. Diversity policies .............................................................................................................................. 37
3. Onboarding and training policies ............................................................................................. 37
4. Policies for managing conflicts of interest ............................................................................ 38
5. Assessment of the knowledge, skills and experience of the management body and the administrative or supervisory body (individually and collectively) ............................. 39 a. Suitability assessments in special cases .................................................................................... 39 b. Individual suitability assessment .................................................................................................. 40

Page 4 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act c. Collective suitability assessment .................................................................................................. 41 IV. Specific obligations of members of management bodies .............................................. 41

1. Notification of direct holdings by members of a management body ........................ 41
2. Proper system of governance .................................................................................................... 41
3. Key functions in the institution .................................................................................................. 42 V. Specific obligations of administrative or supervisory bodies, committees ............... 43
4. Obligations of administrative or supervisory bodies ........................................................ 43
5. Committees of the administrative or supervisory body ................................................... 44 a. Establishment of committees ........................................................................................................ 44 b. Composition of committees .......................................................................................................... 45 c. Duties of committees ....................................................................................................................... 45 d. Procedural aspects ............................................................................................................................ 46
6. Audit committee.............................................................................................................................. 46
7. Nomination committee ................................................................................................................ 47 a. Selection of candidates ................................................................................................................... 47 b. Diversity in the management body and the administrative or supervisory body ..... 47 c. Assessment of the knowledge, skills and experience of the management body and the administrative or supervisory body (individually and collectively) ....................... 48 d. Review of the management body’s principles for the selection and appointment of persons at the senior management level............................................................................... 49 VI. Measures against members of an administrative or supervisory body...................... 49 2 Information on data protection ..................................................................................... 52 3 Annex I – Definitions ....................................................................................................... 53 4 Annex II: Examples of how mandate restrictions are counted .................................... 58 5 Annex III: Overview of mandate restrictions ................................................................ 62

Page 5 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act 1 Requirements I. Notification requirement and necessary documents

1. General guidance on the notification requirements Unless otherwise indicated, the notifications to be submitted in accordance with the KWG and any accompanying documents must be submitted by the institutions1 to BaFin and the relevant Deutsche Bundesbank Regional Office. More detailed information on whether and which electronic submission methods must be used can be found on the respective websites of BaFin and the Deutsche Bundesbank. Legal basis: The “Regulation Concerning Reports and the Submission of Documentation under the Banking Act” (Verordnung über die Anzeigen und die Vorlage von Unterlagen nach dem Kreditwesengesetz – AnzV) governs the details of notifications and documents to be submitted under the KWG.– section 1 of the AnzV: Submission procedure, electronic submission methods, – section 5 – section 5f of the AnzV possibly in conjunction with section 16 (2) of the AnzV: Necessary documents Credit institutions that are affiliated with to a credit cooperative audit association or are audited by the auditing agency of a savings bank and giro association must submit the notifications and any accompanying documents via their association.2 SIs must also comply with other legal requirements: among other things, “Council Regulation (EU) No. 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions” (SSM Regulation) and “Regulation (EU) No. 468/2014 of the ECB of 16 April 2014 establishing the framework for cooperation within the Single Supervisory Mechanism between the European Central Bank and national competent authorities and with national designated authorities” (SSMFR) govern the direct supervision of SIs by the ECB within the framework of the Single Supervisory 1 For reasons of readability, mixed financial holding companies are not explicitly mentioned in this circular in all cases. The question of whether these requirements also apply to them is clarified in the legislation. In cases where the KWG or this Circular require actions to be taken by “the institution”, “institution” should not be considered to have the meaning it has under company law. This means that actions do not have to be undertaken by the institution’s legal representative. Rather, actions can also be taken by other bodies such as administrative or supervisory bodies, owners/guarantors, either separately or jointly. It is the joint responsibility of all bodies to arrive at suitable agreements on this matter. 2 BaFin has received the declaration of consent required under the AnzV from the relevant association for all credit institutions that were authorised at the time the Circular came into force.

Page 6 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act Mechanism and the details of its implementation. – Article 4 of the SSMFR: Tasks conferred on the ECB – Article 6 of the SSMFR: Single Supervisory Mechanism, definition of SI – Article 93 of the SSMFR: Assessment of suitability- Article 94 of the SSMFR: Ongoing review of suitability – List of SSM institutions – see section 1 (5) of the KWG on “Supervisory authorities” and section 24 (3c) of the KWG, section 1 (4) of the AnzV on the notification procedure Institutions must submit the required notifications to BaFin and the Deutsche Bundesbank without delay. BaFin generally assumes that a notification has been made without delay if a period of two weeks after the decision by the competent body in the case of members of a management body or after the appointment in the case of members of an administrative or supervisory body has not been exceeded. As a minimum, the documents to be submitted in accordance with paragraph 34 et seq. and paragraph 44 et seq. (e.g. official certificate of good conduct, extract from the Central Trade and Industry Register) must at least have been applied for within the aforementioned period. The costs for the documents to be submitted will not be covered by BaFin. If not all documents/information are available, e.g. because documents have to be obtained from third parties (register extracts, etc.), the notification must still be submitted and the missing documents/information must be submitted without undue delay. If there is any doubt about the form, content and scope of the notifications, it is generally advisable to contact the relevant division at BaFin or Deutsche Bundesbank Regional Office. For SIs, the ECB assesses the expertise of the members of an administrative or supervisory body and performs the suitability assessment of members of a management body, as well as the reliability and availability of the members of the governing bodies, and directly informs the institution of the outcome of its assessment. The assessment is based on the requirements of the KWG (see Article 4(3) of the SSMFR). To ensure the standardisation of the information used for the supervisory suitability assessment of the members of the SI’s governing bodies, which must be submitted by the institutions, the ECB, in cooperation with the national supervisory authorities, has developed a questionnaire (Fit and Proper Questionnaire) and implemented it in its IMAS portal. SIs directly supervised by the ECB may submit the notification and all accompanying documents in German or English (for documents in other languages, see the comments in the following paragraph. This does not affect the language arrangements agreed between the ECB and the institution. Subject to any statutory exceptions, LSIs must submit the notification and all accompanying documents and declarations in German. If documents are not issued in German, a translation is required in addition to the original foreign-language document, subject to any statutory

Page 7 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act exceptions. Under certain circumstances, this translation must be certified or prepared by a publicly appointed or sworn interpreter or translator. The relevant BaFin division may waive the requirement for documents in English to be translated. 2. Persons and matters to be notified The institution or the (mixed) financial holding company must report the following facts:

• The intention to appoint, implement, terminate or change the appointment of members of a management body and the intention to authorise persons to solely represent the institution3 (e.g. holders of individual special statutory authority (Einzelprokuristen), general authorised representatives if applicable) in accordance with section 24 (1) No. 1 of the KWG. This does not apply to extensions of existing mandates of members of a management body. Section 24 (1) no. 2 of the KWG must be observed for any termination.
• Persons who are actually to manage the business of the (mixed) financial holding company (intention of appointment, implementation) in accordance with section 24 (3a) sentence 1 no. 1 and sentence 5 of the KWG. This also applies to termination (section 24 (3a) sentence 1 no. 2 and sentence 5 of the KWG).
• Substitute members of a management body (appointment and resignation) who are to perform the functions of a member of a management body in the event of their incapacity, section 5f of the AnzV. This currently applies to substitutes under savings bank law.
• The intention to appoint part-time members of a management body.4
• The appointment of members of an administrative or supervisory body, see section 24 (1) no. 15 and (3a) sentence 1 no. 4 and sentence 5 of the KWG, as well as members of an advisory board equivalent to an administrative or supervisory body5 . This does not apply to the extension of existing administrative or supervisory body mandates through re-election. The termination of members of an administrative or supervisory body must still be reported without undue delay, even if it is the result of a failed re￾election or a decision not to stand for re-election. ((section 24 (1) no. 15a and (3a) sentence 1 no. 5 of the KWG)
• In addition, alternate members of an administrative or supervisory body must also be notified at the time of their election, regardless of whether they actually serve. 3 However, these do not mean members of a management body within the meaning of section 25c of the KWG. In this respect, this Circular is only applicable to holders of individual special statutory authority (Einzelprokuristen) to the extent that it addresses issues relating to the notification requirement under section 24 of the KWG. 4 In line with long-standing administrative practice, BaFin does not require the relevant audit association to forward notifications of appointments of honorary members of the management bodies of credit cooperatives. 5 see definition of administrative or supervisory body.

Page 8 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act

• Substitute members for administrative or supervisory bodies must only meet all the requirements for exercising their mandate when they actually take up their position The notification requirement only applies at this date.
• Notification is required if new members of governing bodies are appointed in the course of corporate transformations. The timing of a new appointment is governed by the provisions of transformation or company law.
• In addition, any application for authorisation in accordance with section 32 of the KWG or Commission Delegated Regulation (EU) 2022/2580 must contain information on the future members of a management body and the members of an administrative or supervisory body. Any application for authorisation in accordance with section 2f of the KWG must be accompanied by information on the persons who actually (or are to) manage the business of the (mixed) financial holding company.

3. Timing of the notification requirement a. In the case of an intention to appoint members of a management body Even the intention to appoint a member of a management body must be notified if there is a sufficiently specific intention to appoint a member of a management body, This is the case if the responsible governing body of the institution has made the relevant decision, even if this is subject to the decision of other bodies or feedback from BaFin. The notification must include the date on which the member of a management body is to be appointed. For more information on the notification obligations affecting the members of a management body, see also Part 1IV. Specific obligations of members of management bodies. b. In the case of appointment of members of an administrative or supervisory body The institution must submit the notification without undue delay after the appointment, stating the date on which the member of an administrative or supervisory body was appointed.
4. Necessary documents If LSIs not supervised by BaFin do not use the MVP Portal, they must submit the following forms for the various notifications:6 6 For documents sent by email, we recommend using the following subject line: “BA (supervisory division no. )-(BAK no./Bundesbank lender number) (last name, first name) appointment (member of an administrative or supervisory body or member of a management body)”.

Page 9 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act

• Members of a management body and persons who actually manage the business of a (mixed) financial holding company: PVGLSI (AnzV – Annex 1)
• Members of an administrative or supervisory body: PVVALSI (AnzV – Annex 2)
• PVZLSI (see paragraph 24 et seq, paragraph 50 et seq., paragraph 55 et seq., AnzV – Annex 2a),
• NTLSI (see paragraph 65 et seq., AnzV – Annex 6). The institution must attach the following documents/declarations to the notification of the appointment or intention to appoint, or enter the following information in the forms referred to:
• CV– see paragraph 22 et seq.,
• evidence of continuous professional development, if applicable – see paragraph 94 et seq.,
• information on reliability – see paragraph 24 et seq.,
• “certificate of good conduct for submission to an authority”, “European certificate of good conduct for submission to an authority” or “corresponding documents” from abroad – see paragraph 34 et seq.,
• Extract from the Central Trade and Industry Register – see paragraph 44 et seq.,
• overview of other mandates as a member of a management body and of administrative or supervisory bodies – see paragraph 50 et seq.,
• information on availability – see paragraph 55 et seq. Checklists are available on BaFin’s website that the notifying institution can use to verify that the documents to be submitted for members of an administrative or supervisory body or for members of a management body are complete. By submitting the information and declarations of the member of the governing body to be attached to the notification, the notifying institution confirms that the information submitted is correct to the best of its knowledge. If the newly appointed member was or is already a member of the governing body of another undertaking supervised by BaFin, the institution must resubmit all documents/declarations to be submitted in connection with the notification. BaFin may waive this requirement in individual cases. For information on the requirements for interim appointments, e.g. in the case of cover for parental leave, see paragraph 191. In accordance with section 1 (4) of the AnzV, SIs must use the IMAS portal for the notifications listed on BaFin’s website. In all other cases, the existing submission method continues to apply. a. CV The specific information to be provided and documents to be attached are listed in section 5a of the AnzV.

Page 10 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act If a member of the governing body has resided outside Germany in the last ten years, the relevant period and country must be specified. Furthermore, the institution must disclose if the place of residence and the place of professional activity were not located within the same country. This information is relevant for BaFin to the extent that it affects the register extracts to be submitted (see paragraph 34 et seq.). b. Information on reliability The member of the governing body of an LSI must submit a declaration in form PVZLSI (Annex 2a of the AnzV) providing information on any criminal and administrative offence proceedings, trade law decisions and property law proceedings. The member of the governing body of an SI must submit the relevant declarations via the IMAS portal. The following explanations apply mutatis mutandis. Criminal proceedings in accordance with section 5b (1) sentence 2 of the AnzV may be omitted from the declaration. By contrast, criminal proceedings that have been discontinued in accordance with sections 153 and 153a of the Code of Criminal Procedure (Strafprozessordnung – StPO) and other provisionally discontinued criminal proceedings must be disclosed unless the shortest period specified in section 46 of the BZRG has expired. Discontinuation within the meaning of these provisions does not affect the presumption of innocence under criminal law; nevertheless, the facts of the case may reveal indications of unreliability, in particular in proceedings relating to criminal offences against relevant supervisory law, property or insolvency offences, tax offences, money laundering offences and terrorist financing. Comparable cases under other jurisdictions must also be disclosed. If proceedings are disclosed, copies of rulings, decisions, sanctions, notices or other relevant documents must be enclosed. BaFin reserves the right to obtain further information from the competent authorities if necessary. To assess any conflicts of interest, the member of the governing body of an LSI must provide information in form PVZLSI (Annex 2a of the AnzV) in accordance with section 5b (2) (no. 1) of the AnzV. If no information. is provided in the form, this shall be treated as a nil notification In accordance with section 5b(2) no. 2 of the AnzV, the member of the governing body of an LSI must indicate in the form referred to above any business relationships that could result in a certain degree of economic dependence on the notifying undertaking and describe the nature and scope of those business relationships. The member of the governing body must also disclose:

• legal proceedings between the member of the governing body of an LSI or an undertaking managed by them and the notifying undertaking and its parent undertaking or subsidiaries,

Page 11 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act

• conflicting interests of the member of the governing body of an LSI or an undertaking managed by them or a close relative with regard to the notifying undertaking and its parent undertaking or subsidiaries. The member of the governing body of an SI must submit the relevant declarations in the IMAS portal. c. “Certificate of good conduct for submission to an authority”, “European certificate of good conduct for submission to an authority” or “corresponding documents” from abroad (1) General guidance on official certificates of good conduct Depending on their nationality and place of residence, members of the governing body must submit, in the original, a "certificate of good conduct for submission to an authority" (document type "O") from the Federal Office of Justice in accordance with section 30 (5) of the BZRG ("official certificate of good conduct"), a "European certificate of good conduct for submission to an authority" in accordance with sections 30 (5), 30b of the BZRG (‘European official certificate of good conduct’) or corresponding (country of residence) certificates of good conduct or certificates of assessment of reputation carried out by supervisory authorities in the country of residence in consultation with the relevant BaFin division ("corresponding documents"). Federal Central Criminal Register (BZR) The Federal Central Criminal Register is maintained by the Federal Office of Justice (BfJ), and the details are governed by the Federal Central Criminal Register Act (Bundeszentralregistergesetz – BZRG). Criminal convictions, decisions by administrative authorities and courts, records of legal incapacity and findings by German courts and authorities are entered in the register. Entries are removed under the conditions set out in the law. Any person may apply for a certificate of good conduct for themselves and, under certain conditions, authorities may also request information. Persons who have been resident in different countries over the last ten years must submit certificates of good conduct and corresponding documents from each of these countries (see section 5c (4) of the AnzV). Any legal obstacles to the provision of such documents must be justified by the person concerned to the relevant BaFin division. For countries where a certificate of good conduct is issued by a public authority, it may not be replaced by other documents. An “official certificate of good conduct” should not be confused with a “comprehensive certificate of good conduct” (erweitertes Führungszeugnis) in accordance with section 30a of the BZRG.

Page 12 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act The application for an “official certificate of good conduct” and a “European official certificate of good conduct”7 must be submitted by the member of the governing body to the local registration office (section 30 (2) sentence 1 of the BZRG) or electronically to the BfJ (section 30c (1) sentence 1 of the BZRG). German citizens residing outside of the Federal Republic of Germany can submit their application directly to the BfJ as the registration authority (section 30 (3) sentence 1 of the BZRG). To enable BaFin to assign the incoming certificates of good conduct to the undertaking, the name of the notifying undertaking and the BAK number must be specified as the reference. The official certificate of good conduct must be current, i.e. it may not be older than three months at the relevant date (see section 5c (2) of the AnzV). Any certificate of good conduct already held by BaFin that will be used may not be older than twelve months. Both the “official certificate of good conduct” and the ”European official certificate of good conduct” are sent directly to BaFin by the BfJ. It is not necessary to request further copies for the Bundesbank or, in the case of credit institutions belonging to an association, for the audit association, or in the case of SIs, for the ECB (see section 24 (3c) sentence 2 of the KWG). (2) Specific guidance on official certificates of good conduct The following specific certificates of good conduct and documents must be submitted: Governing body member with Document German citizenship and Residence in Germany An “official certificate of good conduct” issued by the BfJ Residence in another member state of the European Union or in a third country An “official certificate of good conduct” issued by the BfJ and “corresponding documents” from the country of residence Citizenship of a member state of the European Union and Residence in Germany a “European official certificate of good conduct” issued by the BfJ8 Residence in a member state of the European Union or in a third country “corresponding documents” from the country of residence 7 Further information can be found at the following link: www.bundesjustizamt.de. 8 The BfJ has published explanations regarding the European certificate of good conduct on its website.

Page 13 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act Citizenship of a third country and Residence in Germany a “European official certificate of good conduct” issued by the BfJ Residence in another member state of the European Union or in a third country “corresponding documents” from the country of residence If there are special circumstances affecting residence (e.g. change of country of residence within the last ten years) or nationality (e.g. multiple nationalities of EU/EEA countries, third countries) that are not covered by the cases listed above, the institution must coordinate the scope of the documents to be submitted with the relevant BaFin division. d. Extract from the Central Trade and Industry Register In addition, the member of the governing body must submit, in the original, an extract from the Central Trade and Industry Register (GZR)9 to BaFin in accordance with section 150 of the Trade Regulation Code (Gewerbeordnung – GewO). The application for an extract from the GZR must be submitted by the member of the governing body themselves to the competent local authority – generally the registration authority or trade supervisory office – sections 150 (2) and 155 (2) of the GewO in conjunction with the relevant federal state regulations – or electronically to the BfJ (section 150e of the GewO). Persons who reside outside of the Federal Republic of Germany can submit their application directly to the BfJ as the registration authority (section 150 (3) of the GewO). An extract from the register must be applied for as a natural person. The following instructions apply to completing official form “GZR 3” of the Second General Administrative Regulation for the Implementation of Title XI – Central Trade Register – of the Trade Regulation Code (Zweite allgemeine Verwaltungsvorschrift zur Durchführung des Titels XI - Gewerbezentralregister – der Gewerbeordnung) (2. GZRVwV – Instructions for completion) dated 29 July 1985:

• enter key number “1” in field 01 Document type,
• leave both boxes in field 20 blank. To enable BaFin to assign separately incoming extracts from the GZR to the undertaking, the name of the notifying undertaking and the BAK number must be specified as the reference. The extract must be current, i.e. it may not be older than three months at the relevant date (see section 5d (2) of the AnzV). Any extract from the GZR already held by BaFin that will be used may not be older than twelve months. 9 sections 149 et seq. of the GewO.

Page 14 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act Under the statutory provisions of the GewO, the BfJ does not send the extract from the GZR directly to BaFin, but to the applicant. It is not necessary to request further copies for the Bundesbank or, in the case of credit institutions belonging to an association, for the audit association. BaFin generally waives the requirement to submit a German GZR extract (see section 5d (1) sentence 2 of the AnzV) and the requirement to provide comparable foreign documents for persons who have not previously been resident in Germany or have not previously been employed in Germany. BaFin reserves the right to require additional documentation in individual cases. e. Overview of other mandates as a member of a management body and of administrative or supervisory bodies To enable assessment of compliance with the regulatory limits on mandates for members of governing bodies and sufficient availability, the persons concerned must declare any other mandates they hold or report a nil return. Where possible, the member of the governing body of an LSI must provide this information primarily via the MVP Portal or. if this is not possible, they must use form PVZLSI (Annex 2a of the AnzV). The member of an administrative or supervisory body of an SI must submit the relevant declarations via the IMAS portal. These statements apply to SIs mutatis mutandis. In accordance with section 5b(2) of the AnzV, all activities as a member of a management body and all mandates on the administrative or supervisory body of all undertakings must be disclosed, regardless of whether they are supervised by BaFin and regardless of whether or not individual mandates are included in the maximum number of permitted mandates. The term “undertaking” is not limited to specific legal forms and generally includes undertakings and organisations that do not primarily pursue commercial objectives. When it comes to the maximum number of permitted mandates, a distinction must be made between CRR credit institutions that are significant within the meaning of section 1 (3c) of the KWG and all other institutions (see the remarks on mandate restrictions under paragraphs 130 et seq. and 161 et seq.), whereby irrespective of this, all members of the governing bodies must devote sufficient time to performing their duties. If several mandates held by a member of a governing body are considered to be one, this must be substantiated by means of appropriate explanations or documents. Administrative or supervisory body mandates of a senior municipal administrative officer in a municipal undertaking or municipal special-purpose association that they are obliged to exercise by virtue of municipal regulations must be substantiated by the relevant municipal regulations. In the case of mandates representing the federal government or the federal states, the relevant legal basis must be specified or the relevant statutory provisions attached.

Page 15 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act f. Information on availability The notification must contain all facts that are essential for assessing whether the person has sufficient availability to perform the duties. The person must therefore take a holistic view of all activities and mandates they already perform and estimate how much time the new mandate will take.10 The information must be provided by the member of the governing body of an LSI – where possible – primarily via the MVP Portal or, if this is not possible, using form PVZLSI (Annex 2a of the AnzV). The member of the governing body of an SI must submit the relevant declarations via the IMAS portal. These statements apply to SIs mutatis mutandis. In addition to memberships of governing bodies, all full-time and part-time professional activities of the member must be disclosed. The member must not only estimate the actual working hours/meeting times, but also all other time spent on the activity, such as time for meeting preparation and follow-up, work in committees and, where applicable, travel time, training and continuing professional development. This also covers special situations at institutions that may suddenly increase the amount of time required. Insignificant voluntary activities that can be classified as part of private life (e.g. voluntary work in a local sports club) do not need to be included. 5. Notification of completed appointment of a member of a management body The institution must issue a notification of completion as soon as the member of a management body has been legally appointed. If any facts have come to light since the institution or undertaking submitted its notification of intent that significantly affect the suitability, reliability and availability of the notified person, these must also be disclosed. If there is a period of more than twelve months between the notification of intent and the notification of completion, the institution and the person must resubmit the documents that were to be attached to the notification of intent in an updated form. This also applies to register extracts. BaFin may waive this requirement in individual cases. If an institution changes or withdraws its intention to make an appointment, it must also notify this without undue delay. If the change affects the date of the appointment, the institution must indicate the new date. 6. Notification requirement in the event of termination The institution must notify the termination of a member of a governing body in accordance with: 10 The member must estimate the time required for all activities and mandates they perform, including the mandate being notified, and report this to BaFin for each individual mandate or activity in accordance with the instructions in the relevant forms. For mandates on administrative or supervisory bodies, the number of meetings per year must also be specified.

Page 16 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act

• section 24(1) no. 2 of the KWG, section 5e of the AnzV,
• section 24 (1) no. 15a of the KWG, section 5e of the AnzV,
• section 24 (3a) sentence 1 no. 2, sentence 5 of the KWG, section 5e, section 16 (2) of the AnzV,
• section 24 (3a) sentence 1 no. 5, sentence 5 of the KWG, section 5e, section 16 (2) of the AnzV without undue delay. Termination of members of an administrative or supervisory body also applies to situations where a member does not stand for re-election after the end of their regular term of office or is not re-elected. The notification must state the reasons for termination in accordance with section 5e of the AnzV. BaFin also requests submission of an updated overview of the composition of the governing body.

7. Personal disclosure obligations – other activities of a member of a governing body Notifications regarding the commencement and termination of activities at other undertakings in accordance with section 24 (2a) and (3) sentence 1 no. 1 of the KWG and section 10a of the AnzV are necessary to enable the supervisory authority to monitor compliance with supervisory mandate restrictions and the requirement for sufficient availability on an ongoing basis. The notification requirement applies regardless of whether or not individual mandates are included in the maximum number of permitted mandates. Paragraph 51-54 applies mutatis mutandis. In accordance with the provisions of section 24 (3c) of the KWG, SIs are required to notify the Deutsche Bundesbank, BaFin and the ECB. Other activities that are not related to membership of governing bodies may be reported under the category of “New facts”.
8. Notification of new facts New facts that have a significant impact on the original assessment of reliability, suitability or expertise and sufficient availability must also be notified without undue delay after they become known (see section 24 (1) no. 1, 15 and (3a) no. 4 of the KWG11). Such new facts are in particular:

• the initiation of criminal or relevant official administrative proceedings,
• the assumption of a position as chair (management body, administrative or supervisory body or committee) or as a member of a committee, or
• a decrease in availability. 11 For undertakings supervised by the ECB, Article 94(1) sentence 1 of the SSMFR must be observed.

Page 17 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act 9. Administrative fines for breach of notification obligations Breaches of notification obligations are administrative offences that are punishable by an administrative fine of up to EUR 100,000 in accordance with section 56 (2) no. 1 f) j) (6) no. 4 of the KWG. “Breaches of notification obligations” mean that a notification is not made, not made correctly, not made completely or not made promptly in accordance with paragraph 3. This also applies to the notification of new mandates and ancillary activities. II. Requirements for members of governing bodies Members of a governing body must meet the requirements set out in section 25c (1) of the KWG, section 25d (1) of the KWG and section 2d (1) of the KWG, and should have the knowledge set out in paragraph 63 of EBA/GL/2021/06. All requirements apply mutatis mutandis to alternate members of an administrative or supervisory body and substitute members of a management body in the event of absence (section 5f of the AnzV). Paragraph 10applies to substitute members of an administrative or supervisory body. The criteria required by law must be met at all times, and not only at the date of appointment. This also includes the collective fit and proper assessment of the members of the governing bodies in accordance with section 25c (1a) and section 25d (2) of the KWG. Notwithstanding the supervisory assessment, the primary responsibility for the initial and subsequent individual and collective suitability assessments remains with the institutions.

1. Theoretical and practical knowledge a. Professional qualifications of members of a management body Professional qualifications for managing an institution within the meaning of the KWG mean that a member of a management body has adequate theoretical and practical knowledge of the business concerned, as well as managerial experience. The requirements for the professional qualifications of a member of a management body are measured against the size and structure of the institution and the nature, diversity and complexity of the business conducted by the institution, and are assessed on a case-by-case basis. There is therefore no single standard of professional qualifications for members of management bodies – each institution is assessed individually by BaFin. Separate guidance on professional qualifications applies to undertakings that exclusively provide crypto custody services. The explanations on the professional qualifications of members of the management body at undertakings that provide crypto securities register maintenance services are also considered. The theoretical and practical knowledge as well as the management experience of a member of a management body must always be up to date. The extent to which knowledge acquired abroad can be considered will be examined on a case-by-case basis. In principle, members of a management body who do not have corresponding experience in national/European

Page 18 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act supervisory law should provide evidence of relevant further training or have worked for at least six months in a suitable position at a German or European institution. Members of a management body must have sufficient knowledge of German or English to ensure direct communication with the supervisory authority, among other things. A person will normally be assumed to have the professional qualifications if they can demonstrate three years of managerial experience at an institution of comparable size and type of business, see section 25c (1) sentence 3 of the KWG. This is an assumption based on the following conditions:

• “managerial experience”: i.e. a position as a member of a management body or directly below the level of a management body with not insignificant decision￾making powers and representative authority, both internally and externally. Integration into overall bank control is also necessary. In the case of credit institutions, exceptional credit expertise is particularly important. The activity must have been successful.
• “at an institution”
• “of comparable size and type of business”: the size of an institution is generally measured by its total assets, although BaFin may also consider other criteria, such as the number of employees, the structure of the lending business, the volume of deposits under management or the number of customers, when assessing comparable size. A comparable size is generally assumed to be up to three times the total assets. As a general rule, institutions that have a similar business focus and engage in the same banking or financial services are considered to have a comparable type of business. The presumption is rebuttable. Where the presumption does not apply, BaFin will thoroughly examine a person’s professional qualifications as a member of a management body, and evidence of these qualifications must be provided. (1) Theoretical knowledge Sufficient theoretical knowledge can be demonstrated by completed vocational training, degree programmes and courses, particularly in economics, business administration, tax law, general law and banking, considering the tasks associated with the position and, where appropriate, information technology12. For example, this could be vocational training as a banking professional (Bankkaufmann/Bankkauffrau), including further courses at the academies of the leading associations, or a degree in business administration or economics. In principle, sufficiently broad professional experience can also convey the necessary theoretical knowledge. 12see BaFinJournal 12/2017: “IT expertise in management” (p. 15) and BaFinJournal 06/2021: “Bank management body members with special qualifications” (p. 42).

Page 19 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act (2) Practical knowledge To demonstrate professional qualifications, the member of a management body must have practical experience in banking, financial services or payment services/e-money business. In particular, professional experience in the activities that characterise the institution's business (core business areas), such as lending, trading or payment transactions, and risk management is generally indispensable. These must be senior positions, i.e. positions high up in the hierarchy with corresponding responsibilities. Members of the management bodies of Bausparkassen must have sufficient experience in the lending and Bauspar business (particularly in the collective business) (see section 2 (1) sentence 2 no. 2 of the Bausparkassen Act). Sufficient experience is acquired over a period of at least twelve months. Members of a management body of Pfandbrief banks must comply with section 2 (1) sentence 5 of the Pfandbrief Act. (3) Management experience Members of a management body have sufficient management experience if they have managed undertakings in their previous professional life or have been entrusted with the management of organisational units where they supervised employees and exercised independent responsibility with decision-making authority. A member of a management body must be thoroughly familiar with the obligations that an undertaking has to fulfil. The undertakings do not necessarily have to be institutions. BaFin assesses the extent to which the management experience acquired is adequate for managing the reporting institution based on the size of the undertakings, the number of employees they supervised and the powers both granted and exercised. (4) Collective professional qualifications In addition to the individual professional qualifications of the members of the management body, the institutions must ensure that the management body collectively also possesses all the necessary knowledge, skills and experience (see section 25c (1a) of the KWG) to fulfil its overall responsibility for the proper system of governance and the associated requirements (section 25c (3), 4a and 4b of the KWG) at all times (see also section 25d (11) sentence 2 nos. 1, 3 and 4 of the KWG, in particular with regard to the requirement to consider the “balance and diversity of knowledge, skills and experience of all members of the relevant governing body’”)13 . The management body should collectively have a balanced level of knowledge, skills and experience that is appropriate to the business model, risk appetite, strategy and markets in which the institution operates. 13 see also: section 7b (1) sentences 4 and 5 of the KWG in conjunction with Article 16 of the EBA Regulation (Regulation (EU) No 1093/2010) EBA/GL/2021/06 Title II Section 2, Title III Part 7 and Title VII Parts 17, 19, 20.

Page 20 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act The decisive factor is that the management body is collectively and at all times fully capable of managing the institution with regard to its principal risks. Specialists contribute their particular expertise to the collective suitability. This might include, for example, specialist IT expertise tailored to the specific business model. However, particular expertise in a discipline that is important to the institution cannot exempt members of a management body from having a fundamental knowledge of banking, which, depending on the business model, also includes knowledge about lending. (5) Onboarding and continuing professional development The KWG requires institutions to make available human and financial resources to facilitate the onboarding of members of a management body and enable them to undertake the continuing professional development necessary to maintain their professional qualifications (see section 25c (4) of the KWG). Onboarding should begin promptly and support an understanding of the institution's structure, business model, risk profile and governance arrangements, as well as the role of the individual members of the management body within it, and encourage awareness of the benefits of diversity. However, individual members of a management body may not derive any direct entitlement to approval for individual continuing professional development from this requirement. BaFin assumes that the institution will assess the need for continuing professional development, which can be met through training courses for the governing body as a whole as well as for individual members. b. Expertise of the members of an administrative or supervisory body The individual members of an administrative or supervisory body and the administrative or supervisory body collectively must meet the requirements of section 25d(1) sentence 1 of the KWG and section 25d(2) sentence 1 of the KWG. (1) Requirements for individual expertise Expertise within the meaning of the KWG means that members of an administrative or supervisory body are professionally capable of adequately controlling (see part Pflichten von VAO), monitoring and actively supporting the development of the institution. For this purpose, members of an administrative or supervisory body must be able to understand the transactions conducted by the institution and assess the risks involved. The members of an administrative or supervisory body must be familiar with the legal requirements that are material to the institution. Members of an administrative or supervisory body do not necessarily need to have in-depth knowledge of all business areas of the institution, but they must be able to recognise when they need information, support or continuing professional development. The requirements for the expertise of members of an administrative or supervisory body are assessed in accordance with section 25d (1) sentence 2 of the KWG, based on the scope and complexity of the business operations, and are evaluated on a case-by-case basis.

Page 21 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act Members of an administrative or supervisory body may already have acquired the necessary expertise through (previous) activities in the same sector, for example as a member of the governing body of a comparable undertaking. Previous work experience in other sectors, in the academic field, in public administration or in political office may constitute the necessary expertise if it has been or is significantly focused on economic and legal issues over a longer period of time and was or is not entirely secondary in nature. General economic expertise is normally assumed in the case of merchants (Kaufleute) within the meaning of sections 1 et seq. of the German Commercial Code (Handelsgesetzbuch – HGB) and farmers and forestry operators who are required to maintain accounting records, as well as other undertakings within the meaning of section 141 of the German Tax Code (Abgabenordnung – AO). These persons may have the necessary expertise, depending on the size and business model of the undertaking and other relevant aspects. The following special circumstances should be considered: (a) Representatives in administrative or supervisory bodies subject to co￾determination requirements In administrative or supervisory bodies subject to co-determination requirements, employees of the relevant group of undertakings who are or were directly involved in the economic and legal processes of the daily business of the supervised undertaking are usually assumed to have the necessary expertise, provided they can demonstrate theoretical banking knowledge. This also applies to elected members of the works or staff council who belong to an administrative or supervisory body, as well as to employee representatives of trade unions, provided that they are familiar with these processes due to their (previous) activities. (b) Members by virtue of their office In the case of senior administrative officers of a regional or local authority (e.g. full-time mayor or district administrator), expertise is generally assumed if, before or since taking office, they have performed activities for a considerable period of time and to a significant extent that were primarily focused on economic and legal issues and were not entirely secondary in nature; theoretical banking knowledge must also be proven. The same applies to the treasurer of a regional or local authority and employees in comparable positions. (c) Continuing professional development The knowledge required for the assumption of the necessary expertise can usually also be acquired through continuing professional development. The question of whether continuing professional development conveys the necessary knowledge can only be decided on a case-by-case basis. BaFin cannot therefore certify continuing professional development programmes in the sense that participating in a specific continuing professional development course is sufficient in every case.

Page 22 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act Evidence of continuing professional development completed prior to the notification of appointment that is relevant for assessing the required expertise, must be submitted together with the notification of appointment. If the requirements for the assumption of the necessary expertise cannot be fully demonstrated at the time of notification of the appointment, but are only met subsequently through continuing professional development, this does not generally constitute an obstacle to activity in an administrative or supervisory body, provided that this continuing professional development is completed within a reasonable period of time. The continuing professional development must cover the fundamental economic and legal processes of the daily business of comparable undertakings, risk management and the function and responsibilities of the members of an administrative or supervisory body, including how they differ from those of the management body, in relation to the specific case and the applicable criteria. It should address the fundamentals of accounting in accordance with the accounting standards applicable to the institution and of supervisory law. As a rule, continuing professional development should be completed within six months of appointment to ensure an appropriate balance between the time spent on continuing professional development and the term of office. In individual cases, the essential demands of the full-time activity, for example in the case of farmers and other similarly seasonal occupations, may justify a longer period of up to one year. Any intention to make use of this exception must be stated in the notification, giving reasons. The period allowed for continuing professional development, which is usually six months, has no influence on liability under company law, which is effective from the date of appointment. BaFin assumes that institutions will continue to carry out planned continuing professional development. If planned continuing professional development is not carried out or is not carried out as planned, this must be reported without undue delay as a new fact (paragraph 66). This does not affect the right to require evidence of continuing professional development in accordance with section 5(3) of the AnzV. The continuing professional development certificates submitted with the notification of appointment must indicate the organiser, content and duration of each case. (d) Onboarding and continuing professional development The member of an administrative or supervisory body should receive important information no later than one month after taking office. Onboarding should be completed within six months. The member of an administrative or supervisory body should understand the structure of the undertaking, its business model, risk profile and the governance regulations of the institution, as well as the role of the individual member of the administrative or supervisory body. This also includes awareness of the benefits of diversity. To ensure that members of an administrative or supervisory body can always make decisions based on the latest information, they are required to keep themselves continuously informed of changes in the institution’s environment. This relates to new legislation or developments in the area of financial products, for example, both within the institution and in the market.

Page 23 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act The KWG requires institutions to make available human and financial resources to facilitate onboarding and the continuing professional development necessary to maintain the required expertise (see section 25d (4) of the KWG. However, individual members of an administrative or supervisory body may not derive any direct entitlement to approval for individual continuing professional development from this requirement. The administrative or supervisory body must determine the collective need for continuing professional development, which can be met through training courses for the governing body as a whole as well as for individual members. (2) Requirements for the knowledge, skills and experience of the administrative or supervisory body collectively, including accounting/auditing In addition to the requirement for individual members to have the necessary expertise, the KWG requires the administrative or supervisory body collectively to have the necessary knowledge, skills and experience to perform its supervisory function and to assess and oversee the management body. This means that the administrative or supervisory body must collectively have the necessary skills to adequately oversee the management body (section 25d (2) sentence 1 of the KWG) 14 . This includes the aspects mentioned in paragraph 70 et seq. of EBA/GL/2021/06. For public-interest entities in accordance with section 316a (2) of the HGB, i.e. publicly traded companies within the meaning of section 264d of the HGB and CRR credit institutions, section 100 (5) of the German Stock Corporation Act (Aktiengesetz – AktG) must also be taken into account. 2. Reliability Members of governing bodies must be reliable. Reliability is assumed if there are no apparent facts that would indicate unreliability. Unreliability must be assumed if there are facts that indicate that, due to personal circumstances, the member of the governing body cannot provide any assurance that they will perform their duties carefully and properly. The personal conduct and business practices of the member of the governing body with regard to criminal or administrative offences, financial, property law and supervisory aspects must be into account. Breaches of the law relating to professional activities, activities at institutions and undertakings, as well as money laundering and terrorist financing, are of particular relevance, both within the German legal system and the legal systems of other countries. BaFin expects undertakings to examine whether persons are on sanctions lists or have relationships with sanctioned persons or undertakings, see section 1b of the KWG. This 14 see also: section 7b (1) sentences 4 and 5 of the KWG in conjunction with Article 16 of the EBA Regulation (Regulation (EU) No 1093/2010) EBA/GL/2021/06 Title II Section 2, Title III Part 7 and Title VII .

Page 24 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act applies both in the context of new or ad hoc assessments and in the context of regular suitability assessments, see paragraphs 188and 237. Unreliability does not necessarily imply fault. If such circumstances arise or have arisen, BaFin assesses on a case-by-case basis whether the relevant member of the governing body is or is no longer reliable with regard to the performance of their duties. Examples of criteria for unreliability include:

• measures taken by BaFin or other (supervisory) authorities that are or were directed against the member of the governing body or an undertaking in which the member of the governing body was or is active,
• criminal offences, in particular in the areas of property, finance and tax, as well as in connection with violations of company, trade, competition, insolvency, capital market or consumer protection law,
• money laundering offences and terrorist financing,
• other offences and violations that are of relevance with regard to management and personnel responsibility or control functions,
• violations of relevant rules of law. Even minor incidents or violations can have a cumulative effect on reliability. Other aspects15 that could indicate unreliability and should therefore be assessed by the institutions include:
• the existence of conflicts of interest,
• the existence of facts that indicate a lack of impartiality. a. Conflicts of interest The institution must consider conflicts of interest within the context of an overall assessment of the circumstances of each individual case. A conflict of interest does not automatically mean that a person is unreliable. Rather, the primary concern is to 1. recognise such a conflict, 2. address it, and 3. if necessary, find a solution. This can be achieved, for example, by ensuring that the person does not participate in certain deliberations/votes of the governing body. Conflicts of interest arise when personal circumstances or the own economic activity of a member of the governing body are likely to impair the independence of their control and supervisory function. 15 see section 7b (1) sentences 4 and 5 of the KWG in conjunction with Article 16 of the EBA Regulation (Regulation (EU) No 1093/2010) EBA/GL/2021/06 Title II Section 1, Title III Parts 9.1 and 9.2.

Page 25 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act A conflict of interest may arise from a change from the management body to the administrative or supervisory body or from

• a family relationship,
• a business relationship or
• economic dependence with or on persons in the supervised undertaking, in a parent undertaking or subsidiary, or with persons who hold a qualifying holding in the supervised undertaking. The institution must assess on a case-by-case basis whether the conflict of interest prevents the mandate from being exercised. The transfer of a person from the management body to the administrative or supervisory body must occur after a period of time that ensures the independent performance of the control and supervisory function. As a rule, conflicts of interest are not sufficiently taken into account if a former member of a management body assumes the role of chair of the administrative or supervisory body after a period of less than two years. Economic dependence exists, for example, if the member of the governing body, a close relative or an undertaking managed by them arranges loans, other banking transactions, financial services or insurance products for the notifying undertaking. In the case of tied agents or other intermediaries who are economically dependent on the institution, BaFin always considers that this is not compatible with simultaneous membership of a governing body. BaFin considers it fundamentally incompatible for employees of an institution to be members of its administrative or supervisory body, unless this is required by law, e.g. co-determination laws or savings bank laws, or unless the person concerned is a member of the works or staff council. A conflict of interest also exists if the member of the governing body – or the undertaking for which they work or in which they are invested – is a borrower of the supervised undertaking who is at risk of default. Conflicts of interest may also arise in the event of legal disputes with the supervised undertaking or its parent or subsidiaries, or in the form of competing interests. In the case of persons who hold a mandate in an institution in connection with their political office, a conflict may arise between the interests of their political mandate and the interests of the institution. These persons are not exempt from disclosing such conflicts of interest. Likewise, the institution is not exempt from reporting this to the supervisory authority and taking appropriate mitigation measures. Members of governing bodies should disclose any potential conflicts of interest to the chair of the administrative or supervisory body at an early stage.

Page 26 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act All administrative or supervisory bodies must communicate, discuss and document any conflicts of interest appropriately and decide how to address them or what measures can be taken to prevent, resolve or mitigate them. In such cases, a member of the governing body should abstain from voting on matters where there is a conflict of interest. Institutions are expected to inform BaFin and the Bundesbank of any identified conflicts of interest, indicating the measures taken to prevent, resolve or mitigate such conflicts of interest. As part of their suitability assessment of members of their governing bodies, institutions are required to assess, in accordance with their policies on managing conflicts of interest, whether actual or potential conflicts of interest exist and how material they are. b. Independence of mind A lack of independence of mind may be indicated, for example, by a member of a governing body failing to engage actively in their duties and being unable to take their own sound, objective and independent decisions and display judgement when performing functions and fulfilling responsibilities. Other circumstances to be taken into account may include the following patterns of behaviour:

• a lack of courage, conviction and strength to evaluate and critically question proposed decisions,
• the inability of members of an administrative or supervisory body to ask the management body critical questions,
• an inability to resist groupthink
• the inability to perform duties independently and objectively. When assessing impartiality, institutions are expected to take into account past and current behaviour, in particular within the institution.

3. Availability Members of governing bodies must commit sufficient time to performing their duties. On the one hand, this means that, taking into account their professional and social obligations, members of the governing body must, by general consensus, be able to devote sufficient time even in special situations that require additional time and, on the other, that they must actually devote the necessary time. The time available for performing duties as a member of a management body may not under any circumstances be less than 50% of working hours, although a higher time requirement can generally be assumed. In principle, it is the responsibility of each individual member of a management body to accept a mandate only if they can devote the time required to perform the duties of that mandate. Against the backdrop of an increasingly digital working environment (e.g. mobile working), technical arrangements must be made to ensure that the management body has access to all necessary information and communication channels at short notice, even in exceptional situations requiring additional time, so as to ensure that the institution has a proper system of governance in accordance with section 25a(1) of the KWG.

Page 27 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act The requirements set out in Chapter 1I.4.f apply to determining availability. The requirement for sufficient availability of time applies regardless of the restrictions on mandates. This means that a member of a governing body may be prevented from accepting another mandate for reasons of time, even if they have not yet reached the maximum number of mandates permitted under the KWG. Mandates that are privileged or disregarded by any mandate restrictions must also be included in the assessment of sufficient availability. BaFin starts from the assumption that every member of an administrative or supervisory body actually devotes the necessary time to the mandate. In BaFin’s opinion, however, this will not be the case if, for example, members of an administrative or supervisory body do not attend most of the meetings of the administrative or supervisory body or do not prepare conscientiously for the meetings. The legal requirement for sufficient availability will generally not be met if a person simultaneously manages several credit institutions. 4. Mandate restrictions Members of governing bodies must commit sufficient time to performing their duties. An excessive number of management and supervisory mandates would prevent them from devoting the necessary time to the mandate of the supervised undertaking. The KWG limits the number of permitted mandates. To prevent conflicts of interest, the law also excludes certain combinations of mandates (section 25c (2) sentence 2, section 25d (3) of the KWG). Anyone who is a member of an administrative or supervisory body may not simultaneously be a member of the management body of that institution16. This prevents any conflict of interest arising from managing an institution and simultaneously supervising their own management. The mandate restrictions under the KWG do not replace the mandate restrictions arising from other laws, e.g. the AktG and the Insurance Supervision Act (Versicherungsaufsichtsgesetz – VAG). These must be observed concurrently. For mandates in foreign undertakings that are subject to foreign financial supervision, different mandate restrictions under the relevant supervisory law may also apply. a. Former management board members in administrative and supervisory bodies In order to prevent former members of a management body from exerting excessive influence on the current management body, only two former members of a management body may belong to an administrative or supervisory body in each case (section 25d (3) sentence 1 no. 2 of the KWG and section 25d (3a) sentence 1 no. 2). Any further appointment of a former member of a management body to an administrative or supervisory body is 16 section 25c (2) sentence 2 no. 1 of the KWG, section 25d (3) sentence 1 no. 1 of the KWG and section 25d (3a) sentence 1 no. 1 of the KWG; In the case of an SE with a unitary board structure, executive directors are the members of the management body. They may not simultaneously perform tasks related to the supervision of the management body.

Page 28 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act prohibited under the KWG. It is irrelevant how long ago the members left the management body; on the other hand, the KWG does not require a waiting period for a switch from the management body to the administrative or supervisory body. b. Strict mandate restrictions (section 25c (2) and section 25d (3) of the KWG) The following strict mandate restrictions apply to

• members of a management body of significant institutions and
• members of an administrative or supervisory body of significant CRR credit institutions. If a (mixed) financial holding company has been designated as the parent undertaking and a CRR credit institution is subordinate to it, the provisions of this Part, section 25d (3) sentence 2 of the KWG, apply to the members of the administrative or supervisory body of these undertakings. If a person holds a mandate that falls under the strict mandate restriction, all of their mandates are subject to the strict mandate restriction, even if individual mandates – taken in isolation – would fall under the simple mandate restriction. The following examples are designed to illustrate this. Mandates that trigger a strict mandate restriction are highlighted. Mandates of a person Applicable mandate regime Member of an administrative or supervisory body – significant CRR-CI Member of an administrative or supervisory body – non-CRR CI Member of an administrative or supervisory body – not a significant CRR-CI Strict mandate restriction Member of an administrative or supervisory body – not a significant CRR-CI Member of an administrative or supervisory body – non-CRR CI Member of an administrative or supervisory body – not a significant CRR-CI Simple mandate restriction Member of a managing body – significant CRR-CI Member of an administrative or supervisory body – non-CRR CI Strict mandate restriction

Page 29 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act Member of an administrative or supervisory body – not a significant CRR-CI Member of a managing body – significant institution Member of an administrative or supervisory body – non-CRR CI Member of an administrative or supervisory body – not a significant CRR-CI Strict mandate restriction Member of a managing body – not a significant institution Member of an administrative or supervisory body – non-CRR CI Member of an administrative or supervisory body – significant CRR-CI Strict mandate restriction As soon as an institution that was previously not significant becomes significant, the mandate restrictions described in this Part apply to the members of the governing bodies of that institution. The provisions of section 64r (13) and (14) of the KWG apply mutatis mutandis to “legacy mandates” that exceed the maximum number of permitted mandates, referred to as “legacy mandate grandfathering”, provided that the institution is an LSI and the number of mandates does not prevent the proper performance of duties within the institution. (1) Other management and supervisory mandates Anyone who manages an undertaking is, as a matter of principle, exposed to a heavy workload from the outset. This also includes working as a member of the management body of an undertaking that is not subject to supervision by BaFin. It is irrelevant whether this activity is performed on a full-time or a part-time basis. For this reason, members of a management body may only hold a maximum of two additional mandates on administrative or supervisory bodies, with the exceptions listed in the following. A member of an administrative or supervisory body who does not hold any management mandates may hold a maximum of four mandates on administrative or supervisory bodies at the same time, with the exceptions listed in the following, section 25d (3) sentence 1 no. 4 of the KWG. Supervisory mandates in all undertakings will be counted, regardless of whether or not the undertakings are supervised by BaFin. (a) Multiple mandates counted as a single mandate Under “privileged treatment”, a fundamentally unlimited number of mandates are counted as a single mandate under the following conditions. However, the member of the governing body must still devote sufficient time to each individual mandate, regardless of whether or not the person has already exhausted the maximum number of permitted mandates. See

Page 30 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act section 25c (2) sentence 3 nos. 1 to 3 of the KWG, section 25d (3) sentence 3 nos. 1 to 3 of the KWG. Mandates as a member of a management body and as a member of an administrative or supervisory body can also be counted together as a single mandate as part of a privilege; in this case, they count as a single management mandate.

• Multiple mandates are considered to be a single mandate if the mandates are held in undertakings belonging to the same group (see Annex II: Examples of how mandate restrictions are counted). The definition of a group in accordance with Article 4(1)(138) of the CRR applies to the determination of the group of undertakings belonging to the group. Practical experience has shown that members of administrative and supervisory bodies with management and/or supervisory mandates in undertakings outside the financial sector or undertakings within the financial sector that do not fall under the group definition in Article 4(1)(138) of the CRR (e.g. leasing and factoring institution groups) have difficulty performing mandates in institutions because, although they are subject to the mandate restrictions of the KWG, they cannot take advantage of the privilege options in the KWG for their mandates. To create a certain degree of balance here, BaFin considers it reasonable for this group of persons to allow the privileging of mandates in undertakings belonging to the same group even if the group does not fall within the CRR group definition. Membership of a group is determined by the applicable accounting provisions or standards (e.g. sections 290 et seq. of the HGB, IFRS 10). This applies to mandates of members of administrative or supervisory bodies with management and/or supervisory mandates in undertakings outside the financial sector or undertakings within the financial sector that do not fall within the group definition under Article 4(1)(138) of the CRR. The privileging of all mandates within a group also applies if a person accepts further mandates on administrative or supervisory bodies or is simultaneously a member of a management body of an institution.
• Multiple mandates are considered to be a single mandate if the mandates are performed at undertakings that belong to the same institutional protection scheme. Mandates at undertakings that belong to the relevant network but are not part of the institutional protection scheme cannot benefit from this privilege.
• Multiple mandates are considered to be a single mandate if the mandates are exercised at undertakings in which the institution holds a qualifying holding (see Annex II: Examples of how mandate restrictions are counted, Example 4).

Page 31 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act Only mandates at undertakings in which the institution holds a qualifying holding can qualify for this privilege – but not mandates at undertakings that hold a qualifying holding in the institution. It is not necessary for the undertakings to be supervised by BaFin. The mandate at the institution that holds the qualifying holding is counted separately from the mandates at the investees. The privileging of all mandates in undertakings in which the institution holds a qualifying holding also applies if a person accepts further mandates, regardless of whether these are mandates as members of a management body or of administrative or supervisory bodies.

• The different categories of mandate privileging are applied separately in each case. It is not possible to combine different mandate privilege categories or to apply privileging at several levels.
• No reciprocal application of mandate privileges under the KWG and other laws (see Annex II: Examples of how mandate restrictions are counted, Example 5) Persons who are both members of an administrative or supervisory body of an institution and of an undertaking subject to the provisions of other laws must comply with all mandate restrictions. The privileges granted to multiple mandates under the KWG and other laws cannot be applied interchangeably, as they may lead to different outcomes. (b) Mandates at organisations and undertakings that do not pursue predominantly commercial objectives The purpose of the exceptions in section 25c(2) sentence 6 and section 25d(3) sentence 6 of the KWG is to grant privileges to mandates in non-commercial undertakings, in particular non-profit undertakings, and to mandates in municipal public service undertakings. Against the backdrop of the underlying principle of mandate restrictions, which is that the accumulation of too many management or supervisory mandates would prevent a governing body member from devoting the necessary time to performing their duties, BaFin interprets the scope of the exemption provision restrictively. Undertakings supervised by BaFin are not eligible for the exemption. The main cases where the exemption provisions apply are, on the one hand, recognised non￾profit organisations or undertakings within the meaning of sections 51 et seq. of the AO and comparable charitable and other non-profit organisations under other legal systems and, on the other hand, undertakings in the field of municipal public services. An undertaking in the field of municipal public services is understood to be an undertaking, regardless of its legal form, that
• is not exclusively or predominantly profit-oriented,
• primarily and directly serves a public purpose through its performance, not indirectly through profits and income, and

Page 32 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act

• is majority-owned by the municipal authority that operates it or is invested in it in such a way that ensures appropriate influence. BaFin also considers the leading banking associations and their regional associations to be undertakings that do not pursue predominantly commercial objectives. Equally, in line with BaFin’s administrative practice, membership of a stock exchange council in accordance with section 12 of the Stock Exchange Act (Börsengesetz) is not considered a mandate that must be taken into account, since stock exchanges, as institutions governed by public law with partial legal capacity can be regarded as not pursuing predominantly commercial objectives for the purposes of this provision, unlike the relevant stock exchange operator. Mandates in undertakings that exclusively serve the private asset management of the person or their family members may, depending on the circumstances of the individual case, be regarded as mandates in undertakings that do not primarily pursue commercial objectives. A case of exclusively private asset management in this sense can no longer be assumed if daily administrative work is involved. Outside the areas of application referred to above, it can only be assessed whether an undertaking can be regarded as predominantly non-commercial by taking into account the specific circumstances of the individual case and the overall picture of the activity to be assessed. The absence of an intention to make a profit is not a suitable sole distinguishing criterion, even if, conversely, the privileges are generally not applicable to undertakings whose sole or predominant purpose is to make a profit. Tax exemptions, in particular corporation tax or trade tax exemptions, are also not a sufficient criterion for the applicability of the privilege due to the fundamentally different purposes of tax law and banking supervisory law. BaFin’s assessment that an undertaking is not predominantly commercial in nature is made solely for the purposes of the KWG. It is not relevant for other authorities, e.g. for deciding on an undertaking’s tax liability. (c) Mandates of senior municipal administrative officers Administrative or supervisory body mandates in a municipal undertaking or municipal special-purpose association that a senior municipal administrative officer is required to exercise by virtue of municipal regulations or statutory provisions are exempt from the maximum mandate restrictions set out in section 25d (3) sentence 10 of the KWG. This applies to the administration management of a municipality, rural district or urban district that, despite the restrictions on mandates imposed by the KWG, must be enabled to exercise an unlimited number of mandates assigned to them by municipal regulations or law in municipal undertakings that are majority-owned by one or more municipalities, cities or rural districts, as well as mandates in municipal special-purpose associations. A condition is that the articles of association of the municipal undertaking, the municipal special-purpose association or the law assign(s) the mandate on the administrative or

Page 33 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act supervisory body solely to the senior administrative officer and that this is substantiated to BaFin. If a senior municipal administrative officer holds additional mandates on administrative or supervisory bodies of undertakings that are neither municipal undertakings nor municipal special-purpose associations, or in other institutions, these mandates are subject to the mandate restrictions set out in section 25d(3) sentence 1 no. 4 of the KWG, unless they may be disregarded for other reasons. Equally, the mandate on the administrative board of the savings bank on which the senior municipal administrative officer represents their regional or local authority is counted as such in the maximum number of permitted supervisory mandates. Based on the wording of the law, the exception can only be applied to the mandates of a senior municipal administrative officer. The exception does not apply to other persons who are members of an administrative or supervisory body by virtue of the articles of association of an institution, e.g. as holders of a political office. (d) Mandates as representatives of the federal government or state governments Mandates on administrative or supervisory bodies in which the member represents the Federal Republic of Germany or one of the federal states of the Federal Republic of Germany are exempt from the maximum mandate limits in accordance with section 25d (3) sentence 9 of the KWG. The condition is that the mandate is assigned to the member or the political function they hold by law or articles of association and that this is substantiated to BaFin. Articles of association provisions substantiating the exception include, for example: The supervisory board consists of:

1. the relevant member of the state governments of states A and B,
2. …, 3. …,
3. five members from state A… The supervisory board consists of
4. the Federal Minister of Finance,
5. the Minister of Finance of state A.
6. … If the member holds further mandates on administrative or supervisory bodies of undertakings or institutions in which they do not represent either the federal government or the federal states, these mandates are subject to the mandate restrictions set out in section 25d(3) sentence 1 no. 4 of the KWG, unless they may be disregarded for other reasons.

Page 34 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act (2) Authorisation of an additional mandate The supervisory authority may, taking into account the circumstances of the individual case and the nature, scale and complexity of the activities of the institutions, group of institutions or financial holding group, the financial holding company or the mixed financial holding company, allow an additional mandate in an administrative or supervisory body to be held if this does not prevent the member from devoting sufficient time to performing their duties in the relevant undertaking (see section 25c (2) sentence 7 of the KWG and section 25d (3) sentence 7 of the KWG). Approval requires an application to be submitted by the person themselves. The application must be submitted informally to the supervisory authority and the relevant Bundesbank regional office. This means that the application must be submitted to the ECB and BaFin if it concerns a mandate in the administrative or supervisory body of an SI, but in all other cases, BaFin will be the recipient. The application must contain a detailed description of the time required, including the number of meetings and other tasks, e.g. committees, that the mandate to be approved will involve. If the mandate is in an undertaking that is not supervised by the supervisory authority, a description of the undertaking’s business purpose, size and structure must be included. The person must additionally provide details of the time required to fulfil the mandates they already hold. The ECB and BaFin must be informed if a mandate is approved by the supervisory authority but no appointment to the administrative or supervisory body occurs. The supervisory authority may only permit the performance of a single additional mandate on an administrative or supervisory body. The additional mandate may only be assumed after authorisation has been granted by the supervisory authority (see section 25d (3) sentence 8 of the KWG). c. Simple mandate restrictions The simple mandate restriction(section 25d (3a) of the KWG) can only be applied if none of the existing mandates triggers the strict mandate restriction (see Part b). For members of a management body of institutions that are not significant within the meaning of section 1 (3c) of the KWG, the number of management or supervisory mandates must take into account the individual case and the nature, scale and complexity of the institution’s business. The mandate restrictions explained in this Part also apply to members of an administrative or supervisory body of financial holding companies in accordance with section 25d (3a) of the KWG. As soon as the person is or becomes a member of an administrative or supervisory body or a member of a management body in a significant institution, the mandate restrictions explained in Part b apply to all of their mandates (both as a member of a management body and as a member of an administrative or supervisory body).

Page 35 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act A member of an administrative or supervisory body may simultaneously hold a maximum of five mandates in administrative or supervisory bodies, with the exceptions listed below. This includes supervisory mandates in all undertakings that are supervised by BaFin (see section 25d (3a) sentence 1 no. 3 of the KWG). “Privileging” means that a fundamentally unlimited number of mandates are considered to be a single mandate if the mandates are performed at undertakings that belong to the same institutional protection scheme. This means that, in practice, members of an administrative or supervisory body can perform more than the five permitted mandates. However, the member must still devote sufficient time to each individual mandate, regardless of whether or not the person has already exhausted the maximum number of permitted mandates. d. Legacy mandate grandfathering The strict mandate restriction does not apply to mandates as members of a management body and mandates in administrative or supervisory bodies that the governing body member already held on 31 December 2013, provided that the institution is not a significant institution. Mandates that exceed the maximum number of permitted mandates and are subject to grandfathering may be extended through re-election or reappointment. However, no further mandates may be assumed: this also applies in cases where the new mandate could be counted as a single mandate together with an existing mandate that is covered by the legacy mandate grandfathering. 5. Administrative fines In the case of members of management bodies., any breach of the obligations referred to above regarding availability and mandate restrictions may constitute an administrative offence punishable by a fine of up to EUR five million in accordance with section 56 (4h) nos. 5 and 6 in conjunction with section 56 (6) no. 1of the KWG. III. General obligations of members of governing bodies – policies and processes Institutions are expected to have adopted the following policies:

• fit and proper policies,
• diversity policies for management, administrative and supervisory bodies, as well as employees,
• onboarding and training policies,
• policies for managing conflicts of interest for management, administrative and supervisory bodies, as well as employees.17 17 see also: section 7b (1) sentences 4 and 5 of the KWG in conjunction with Article 16 of the EBA Regulation (Regulation (EU) No 1093/2010) EBA/GL/2021/06 Title IV Part 11, Title V, VI Parts 13 and 14 EBA/GL/2021/05 Title IV, Section 12.

Page 36 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act BaFin considers this requirement to be met provided that the content is implemented, appropriately documented and communicated. The necessity for and level of detail of these policies depends on the size, internal organisation and nature, scale and complexity of the business of the institution concerned (application of the principle of proportionality). If an institution applies a model policy, e.g. from its association, it must assess whether and to what extent adaptations to the specific circumstances are necessary. Only very small institutions within the meaning of MaRisk may consider waiving these policies.

1. Suitability policies Institutions are expected to establish and maintain policies and processes for individual and collective suitability assessments (suitability policies). These policies are expected to be aligned with the institution's overall operational governance framework, corporate culture and risk appetite. The suitability policies are also expected to include or refer to diversity policies. The policies on suitability assessments should also govern the procedures for selecting and appointing key function holders. Superordinate undertakings within the meaning of section 25c (4b) sentence 1 of the KWG are expected to ensure that a group-wide suitability policy is implemented and complied with in all subsidiaries within the scope of prudential consolidation. When developing the policies, input from internal committees and other internal functions may be sought and taken into account. This applies in particular to the nomination committee, legal and human resources departments, and internal control functions. The compliance function in particular is responsible for analysing how the suitability policies affect the institution’s compliance with laws, regulations, internal policies and procedures. This analysis, including all identified compliance risks and non-compliance issues, must be made available to the management body and the administrative or supervisory body. The suitability policies are expected to contain principles for the selection, oversight and succession planning of governing body members, as well as for the reappointment of existing members, and should, as a minimum, address the following:

• the process for selecting, appointing, reappointing and succession planning for members of governing bodies and the applicable internal procedure for the suitability assessment of a member, including the internal function responsible for supporting the assessment,
• the criteria to be used in the assessment, which must be consistent with the legal requirements and the principles set out in this Circular,
• how the diversity policy for members of governing bodies and the target for the underrepresented gender will be taken into account in the selection process,
• the communication channel to the competent authorities and how the assessment will be documented.

Page 37 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act 2. Diversity policies The institution must set diversity targets for its management body and the administrative or supervisory body in accordance with EBA/GL/2021/06. 18 The diversity policies are expected to address the following aspects of diversity, in compliance with legal prohibitions on discrimination:

• educational and professional background,
• gender,
• age,
• and – especially for institutions that operate globally – geographical origin. In addition, institutions are expected to establish diversity policies for employees below management level.19 When appointing members to its governing bodies, the institution is generally expected to ensure that the bodies represent a broad range of qualities and skills, to promote diversity of opinion and independence of mind, and to contribute to decision-making that serves the long-term interests of the institution. To ensure representation of the underrepresented gender, significant CRR credit institutions are required to define a quantitative target for representation of the underrepresented gender in the management body and in the administrative or supervisory body.20 These must quantify the target representation of the underrepresented gender and specify a suitable timeframe for achieving the target, as well as how it is intended to be achieved. In addition, compliance with the specified targets must be documented as part of the annual review of the composition of the management body and the administrative or supervisory body. In the event that diversity targets are not met, the institution must also document the reasons for this, the measures that are to be taken and the timeframe for these measures to ensure that the diversity targets are met. The diversity policies of other institutions, particularly those with a management body and an administrative or supervisory body that together have fewer than five members, may define a qualitative target. This does not affect any other legal requirements regarding quotas or the definition of diversity targets, such as those contained in section 76 (3a) and section 96 (3) of the AktG.

3. Onboarding and training policies Before commencing their duties, members of a management body and members of an administrative or supervisory body must be informed about the culture, values, behaviour 18 see also Article 435(2)(c) of the CRR for CRR credit institutions. EBA/GL/2021/06 Title IV Part 11, Title V Part 12. 19 see EBA/GL/2021/06 paragraph 107. 20 see also EBA/GL/2021/06 paragraph 103.

Page 38 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act and strategy of the institution and its management body or administrative or supervisory body. Institutions must deploy adequate human and financial resources to facilitate the onboarding of members of governing bodies and enable them to undertake the continuing professional development necessary to maintain their professional qualifications and the necessary expertise (section 25c (4) and section 25d (4) of the KWG).21 For this purpose, they should have policies and procedures for onboarding and training, either as part of the general suitability policies or as separate policies. They must be adapted to current requirements in the event of changes to governance, strategy and other relevant factors, as well as new products or changes to applicable law and market developments. Instead of drawing up their own policies, smaller undertakings can refer to model policies provided by their associations and supplement them with more specific details if necessary. When developing these policies, relevant input from the human resources, financial planning, internal training and, where appropriate, internal control departments should be taken into account. Onboarding and training programmes based on the policies should be developed with the involvement of the relevant business units. As a minimum, the policies and procedures for onboarding and training members of governing bodies should cover the following content:

• separate onboarding and training objectives for management bodies and administrative or supervisory bodies; these objectives should be specified for specific positions based on their specific responsibilities and membership in committees,
• responsibility for developing a detailed training programme,
• the financial and human resources made available by the institution for onboarding and training, taking into account the number and cost of onboarding and training sessions, as well as related administrative tasks,
• a clearly defined process that allows every member of the management body to ask for onboarding or training. Institutions should establish a process for identifying areas where training is needed. They should also have an assessment process for monitoring implementation and quality assurance.

4. Policies for managing conflicts of interest The management body or the administrative or supervisory body are responsible for establishing, approving and monitoring the implementation and updating of effective policies for identifying, assessing, managing and mitigating actual and potential conflicts of interest between the interests of the institution and the interests of employees, members of a management body or of an administrative or supervisory body that may adversely affect the 21 When determining the necessary human and financial resources, the institution should consider existing relevant sector-specific benchmarks, including the benchmarking results provided by the EBA.

Page 39 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act performance of their duties and responsibilities. A superordinate undertaking should ensure that the group has policies for managing conflicts of interest. 5. Assessment of the knowledge, skills and experience of the management body and the administrative or supervisory body (individually and collectively) In accordance with section 25a (1) of the KWG in conjunction with section 25c (1) of the KWG and section 25d (1) and (2) of the KWG, institutions must ensure that the members of a management body and members of an administrative or supervisory body are fit and proper persons at all times, both individually and collectively.22 If no nomination committee has been established, the administrative or supervisory body is expected to perform a complete reassessment of suitability in accordance with section 25d (11) nos. 3 and 4 of the KWG (see knowledge, skills and experience as well as availability and reliability above) at least every two years. a. Suitability assessments in special cases The suitability assessment of the management body or the administrative or supervisory body is performed in particular

• when applying for a licence or authorisation in accordance with section 32 of the KWG or section 2f of the KWG,
• if there are significant changes in the composition of the management body and the administrative or supervisory body, including  the appointment of new members of governing bodies,  the reappointment of members of governing bodies, if the requirements for the position have changed or if the member is appointed to another position on the governing body. This assessment should be limited to members whose position has changed and to the analysis of the relevant aspects, taking into account any additional requirements for the position,
• and where this is required by new facts or situations. An individual suitability reassessment should be performed in particular
• if there are concerns about individual or collective suitability in the management body or the administrative or supervisory body,
• if an additional mandate is assumed or commenced, or new relevant activities, including political activities, are begun,
• in the event of a material impact on the reliability of a member of the management body or a member of an administrative or supervisory body, including cases where members of the governing body do not comply with the conflict of interest policies,
• in cases where the suitability of the members of the governing body could otherwise be materially impaired. 22 see EBA/GL/2021/06 Title II Section 2, Title III Part 7 and Title VII Parts 17, 19, 20.

Page 40 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act A collective suitability reassessment should be performed in particular in the following cases:

• in the event of a significant change in the business model, risk appetite or risk strategy or risk structure of the institution at individual or group level,
• as part of the control of internal governance arrangements by the management body,
• if there is reasonable suspicion that money laundering or terrorist financing is taking place, has taken place or that attempts have been made to commit these offences in connection with this institution, or that there is an increased risk of this happening,
• in cases where the suitability of the members of the governing body could otherwise be significantly impaired.23 If members of a management body leave the institution only temporarily in cases provided for by law, such as parental leave in accordance with section 84 (3) of the AktG, a suitability assessment is only required upon their return if new facts become known that may be relevant to their suitability. During the period of absence, the institution must ensure that the minimum number of members of a management body required to manage or supervise the institution is not undershot. In particular, the dual control principle must be preserved. If a person below management body level who is familiar with the undertaking and the tasks to be performed is designated as an interim member of a management body, the administrative or supervisory body must consider any conflicts of interest that may arise from the change in roles. If the administrative or supervisory body believes that it is reasonable to depart from the general suitability policies in paragraph 171 et seq. for the interim management body member, it must justify this in its selection decision and inform BaFin and the Bundesbank when notifying them of its intention to appoint the interim member. It is sufficient for the undertaking to notify BaFin and the Bundesbank of the revocation of the appointment and the (intended) reappointment and, if applicable, to submit a copy of the extract from the commercial register showing the termination and, at a later date, a copy of the extract from the commercial register showing the reappointment. When notifying a temporary leave of absence, the person who will take over the responsibilities of the temporarily absent member must also be specified. b. Individual suitability assessment For individual suitability assessments, institutions must assess whether the members of the governing body are reliable, have the necessary professional qualifications and expertise for the specific mandate, and can devote sufficient time to their specific tasks. To do so, they may refer to the non-exhaustive list of relevant skills in Annex II to EBA/GL/2021/06. 23 see EBA/GL/2021/06 paragraph 31.

Page 41 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act The institutions must document the individual suitability for the specific position in the institution and compliance with the mandate limits in accordance with section 25c (2) or section 25d (3) or (3a) of the KWG. c. Collective suitability assessment Regular and ad hoc suitability collective assessments for the management body and the administrative or supervisory body are intended to ensure that each of these governing bodies has sufficient professional competence and expertise at all times to understand the institution’s activities, including the main risks, and to perform its functions. The collective suitability assessment must be performed by the institutions either using the EBA’s matrix template, which can be adapted by the institutions in line with the principle of proportionality, or using their own appropriate methodologies based on the relevant criteria. When reassessing collective suitability, the assessment may focus on relevant changes in the institutions’ business activities, business strategies and risk profile, as well as the allocation of tasks within the management body or the administrative or supervisory body and their impact on the collective professional qualifications or collective expertise required. As a result of the reassessment, changes to the composition of the management body or the administrative or supervisory body or other measures may be recommended, such as training, changes to processes, measures to mitigate conflicts of interest, the appointment of additional members with special skills, and the replacement of members of the management body. The management body should acknowledge the report on the results and decide on the recommendations contained in it and, if no recommendations are implemented, it should document the reasons for this. IV. Specific obligations of members of management bodies

1. Notification of direct holdings by members of a management body Members of a management body must, without undue delay, notify the acquisition and disposal of a direct holding in an undertaking, as well as any changes in the size of the holding with regard to certain thresholds (see section 24(3) sentence 1 no. 2 of the KWG, section 11 of the AnzV). A direct holding of at least 25% of the shares in the undertaking's capital is considered a (notifiable) holding.
2. Proper system of governance In accordance with section 25a (1) of the KWG, an institution must have in place a proper system of governance that ensures compliance with the legal provisions to be observed by

Page 42 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act the institution as well as with business requirements.24 Section 25c (3), (4a) and (4b) of the KWG lists the tasks that must be performed by the members of a management body to ensure a proper system of governance and for which they bear (collective) responsibility; see also section 25a (1) sentence 2 of the KWG. A proper system of governance includes in particular ensuring appropriate and effective risk management, which also encompasses the management of IT resources, information risk management and information security management. Risk management also includes ensuring that the institution has adequate personnel and technical and organisational resources.25 In order to ensure a proper system of governance, the members of a management body must individually and collectively possess the necessary expertise in accordance with the nature, scale, complexity and riskiness of the business activities, including in individual cases. In doing so, it must be ensured that the individual departments are managed properly and that mutual control and oversight obligations can be properly discharged. The members of a management body must collectively have an appropriately broad range of knowledge, skills and experience (see also section 25c (1a) of the KWG), including in the area of information and communication technology (ICT). Depending on the institution-specific ICT and security risks, special training courses should therefore be held at regular intervals26 . The reason is that, due to the steadily advancing digitalisation, members of a management body must be aware of the risks associated with the use of the relevant technology (e.g. the use of cloud services) so that they can manage them appropriately. 3. Key functions in the institution Under section 25c (4a) sentence 1 no. 4 of the KWG, a proper system of governance also includes adequate human resources of the institution in accordance with section 25a (1) sentence 3 no. 4 of the KWG. For groups of institutions, (mixed) financial holding groups and institutions within the meaning of Article 4 of the CRR, this must be ensured at group level by the members of the management body of the parent undertaking in accordance with section 25c (4b) sentence 2 no. 4 of the KWG. In BaFin’s view, adequate human resources include, among other things, filling key positions below the level of the management body level with suitable employees.27 Institutions must ensure that their employees are in a position to perform their functions adequately. 24 Among other things, the statutory provisions include the individual suitability requirements and the collective suitability requirements applicable to members of management bodies and members of an administrative or supervisory body (section 25c (1a), section 25d (1) and (2) of the KWG; see EBA/GL/2021/06 Title II Part 2, Title III Part 7 and Title VII Part 17, 19, 20). 25 Section 25a (1) sentence 3 no. 4 of the KWG in conjunction with AT 7.1 and AT 7.2 of the MaRisk. 26 From 17 January 2025, Article 5(4) of Regulation (EU) 2022/2554 (DORA) must also be observed. 27 see: section 7b (1) sentences 4 and 5 of the KWG in conjunction with Article 16 of the EBA Regulation (Regulation (EU) No 1093/2010) EBA/GL/2021/06 Title II Part 3, Title III Part 21.

Page 43 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act The institutions must ensure that key function holders are reliable and have the necessary professional qualifications for their position. The assessment principles applicable to members of a management body may be used for this purpose, with due consideration given to the specific position. V. Specific obligations of administrative or supervisory bodies, committees

1. Obligations of administrative or supervisory bodies The obligations of administrative or supervisory bodies and members of administrative or supervisory bodies result from the relevant provisions of company law and, where applicable, articles of association and rules of procedure. See section 25d(6) of the KWG for information on supervisory obligations. The KWG requires institutions to have a proper system of governance that ensures compliance with the legal provisions to be observed by the institution as well as with business requirements. The members of the management body are responsible for this. The administrative or supervisory body is responsible for controlling and overseeing the management body’s compliance with this obligation. For more information, see section 25a(1) of the KWG. Members of an administrative or supervisory body must perform their duties at all times. In particular, this requires them to monitor the undertaking’s business strategy and risk situation and form an opinion on this. This means that, in addition to attending meetings and preparing for them, members of an administrative or supervisory body must also support the undertaking between meetings, particularly in the event of a significant change in its risk situation. The administrative or supervisory body must collectively have the knowledge, skills and experience necessary to perform the control function and to assess and oversee the management of the institution, see section 25d (2) sentence 1 of the KWG. This also includes expertise in the field of information and communication technology (ICT), which is becoming increasingly important for the administrative or supervisory body in light of the advancing digitalisation of processes and business models from the perspective of its control and oversight function. To ensure that the administrative or supervisory body can properly perform its function in relation to the management body, the members of an administrative or supervisory body are expected to regularly complete relevant training measures. A member of an administrative or supervisory body must meet the requirements of each individual activity and perform the function comprehensively and personally. This requires both sufficient time commitment and, where appropriate, active use of the right of the supervisory body to obtain information from the management body. The members of an administrative or supervisory body must exercise their oversight and control functions diligently so that any material breaches of the principles of proper corporate governance by the management body can be identified and remedied.

Page 44 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act So that they can make appropriate decisions, the members of an administrative or supervisory body must prepare for meetings in advance by referring to the relevant meeting documents. Undertakings must provide the members of their administrative or supervisory body with appropriate documentation in good time to enable them to prepare for meetings. Documents should only be distributed during the meeting itself in justified exceptional cases. It is not sufficient for meeting documents to be prepared and processed exclusively by employees of the administrative or supervisory body. 2. Committees of the administrative or supervisory body a. Establishment of committees The administrative or supervisory body of a significant institution must establish from among its members a risk committee (see section 25d (8) of the KWG), an audit committee (see section 25d (9) of the KWG), a nomination committee (see section 25d (11) of the KWG) and a remuneration committee (see section 25d (12) of the KWG and section 15 of the Remuneration Regulation for Institutions (Institutsvergütungsverordnung – InstitutsVergV). Under section 25d (7) sentence 2 of the KWG, this also applies to the administrative or supervisory body of (mixed) financial holding companies if they have been designated as parent undertakings and a CRR credit institution is subordinate to them. Company law provisions may also require the establishment of committees, e.g. section 107 (4) of the AktG. The KWG does not allow any option to waive the establishment of committees. Depending on its size, internal organisation and the nature, scale, complexity and riskiness of its business, the administrative or supervisory body of an institution that is not classed as significant28 is required to establish from among its members a risk committee, an audit committee, a nomination committee and a remuneration committee. This does not affect the provisions of other laws governing the obligation to establish committees. It is permitted to combine the risk committee and the audit committee (see section 25d (10) of the KWG). The institutions must document the reasons why they decided to combine the committees and how they plan to implement the individual tasks of the committees following the combination. BaFin must be notified of the establishment of a joint risk and audit committee. By contrast, the nomination committee and the remuneration committee must be established separately, and BaFin considers that combining them is not possible as a matter of principle. If, for reasons of proportionality, an institution that is not classed as significant has not established any committees or has established only an audit committee in accordance with section 324 of the HGB, the oversight activities and mechanisms assigned to the committees in section 25d (8) to (12) of the KWG are the responsibility of the body as a whole. 28 As well as for (mixed) financial holding companies other than those specified in section 25d (7) sentence 2 of the KWG.

Page 45 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act All undertakings are required to properly oversee their management bodies. In line with the principle of proportionality, the administrative or supervisory bodies of smaller institutions therefore generally perform the same control functions. However, there are lower requirements in terms of the frequency, intensity and depth of the performance of individual tasks. Both the assessment of whether, in the case of an administrative or supervisory body that is not per se obliged to form committees, it is necessary to establish committees on the basis of the aforementioned criteria, and the procedures for deciding on whether they are necessary and documenting this decision are, in principle, the responsibility of the administrative or supervisory body itself. BaFin does not grant approval for the establishment of committees or for a decision not to establish them. It expects the administrative or supervisory body to decide on the establishment or non-establishment of committees transparently, based on the aforementioned criteria, and to document the decision appropriately. BaFin may require the establishment of one or more committees if this appears necessary for the proper performance of the administrative or supervisory body’s control function. b. Composition of committees A committee should consist of at least three persons and appoint one of its members as its chair. The chair must be able to promote impartial decision-making. In accordance with section 25d (8) sentence 6 of the KWG, the chair of the risk committee should not simultaneously chair the administrative or supervisory body or any other committee. In this context, BaFin would also like to point out that the chair of the audit committee must have demonstrable expertise in the areas of accounting and auditing. The members of the committees should individually and collectively have sufficient knowledge, skills and experience to perform the tasks assigned to the committee. Membership of the risk committee requires sufficient knowledge, skills and experience in risk management and control procedures. Notwithstanding this, institutions should consider rotating the chairs and members of committees on a regular basis. Committee members are expected to participate in open and critical discussions in which conflicting opinions are debated constructively. At least one member of each committee should belong to another committee to ensure cooperation and technical dialogue. Reflecting the size of the administrative or supervisory body, the committees must be composed in such a way that they do not consist of the same group of members who form another committee (i.e., the same members). c. Duties of committees Each committee must be assigned the duties specified in the KWG, and is not allowed to transfer individual duties from one committee to another. Conversely, it is not prohibited to assign additional duties to a committee established in accordance with the KWG. The

Page 46 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act committees support the administrative or supervisory body and facilitate the development and implementation of a robust framework for internal governance. The institutions must ensure that duties and responsibilities are clearly allocated and divided between the committees. Each committee should receive a documented mandate from the administrative or supervisory body, including the scope of its responsibilities, and implement appropriate working procedures. If the KWG assigns tasks to a committee that do not fall within the competence or area of responsibility of the administrative or supervisory body under applicable company law, these tasks are not relevant for the committee in question. This applies, for example, to:

• the engagement of the auditor, e.g. at credit unions and agricultural credit cooperatives,
• the appointment of a member of a management body by the representatives’ meeting. The tasks of the committees listed in the KWG do not constitute an exhaustive list of the tasks involved in the proper performance of the control and advisory functions of an administrative or supervisory body. The fact that they are enshrined in law underlines the special importance of financial sector undertakings and the special role of their supervisory bodies. The lawmakers therefore assign the same tasks to the administrative or supervisory bodies of all institutions, regardless of their size. However, the frequency, intensity and depth with which a committee is required to address the tasks assigned to it depend on the size, internal organisation and nature, scale, complexity and riskiness of the business. d. Procedural aspects The committee must document the agendas of the committee meetings, their key outcomes and conclusions, as well as other relevant information relating to the performance of their duties. The committees must report regularly to the Administrative and Supervisory Board.

3. Audit committee The audit committee must discharge the duties set out in section 25d (9) of the KWG. The chair of the audit committee must have expertise in the areas of accounting and auditing. In addition, provisions of company law such as section 100(5) of the AktG may require other members to have special knowledge. See paragraph 215 et seq. for information on the establishment of an audit committee. CRR credit institutions that do not have an administrative or supervisory body or do not have at least one member with expertise in the field of accounting and at least one other member with expertise in the field of auditing on their administrative or supervisory body must, as public-interest entities, establish an audit committee in accordance with section 324 of the HGB ; this also applies to savings banks, unless otherwise prescribed by federal state law (section 340k (5) of the HGB in conjunction with section 324 of the HGB, section 100 (5) of the AktG).

Page 47 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act 4. Nomination committee The nomination committee supports the administrative or supervisory body with regard to the appropriate appointment and composition of the management body and the administrative or supervisory body in accordance with section 25d (11) of the KWG. For this purpose, it may use any information and resources it deems appropriate and may consult the relevant internal control functions and other responsible internal functions. The members of the nomination committee are expected, individually and collectively, to have sufficient knowledge, skills and experience regarding the selection process and the suitability requirements. a. Selection of candidates The nomination committee actively supports the administrative or supervisory body in cooperation with the human resources department in filling a position on the management board and in preparing nominations for the election of members of the administrative or supervisory body. Among other things, this involves drafting a job description with a candidate profile and the time commitment required for each position to be filled. The further requirements are set out in section 25d (11) of the KWG and paragraph 130f of EBA/GL/2021/06. Smaller and non-complex institutions (SNCIs) may simply distinguish between members of the management body and members of the administrative or supervisory body in their job profiles instead of specifying the time commitment required for the specific position. Appropriate succession planning for the management body and the administrative or supervisory body that complies with all legal requirements regarding the composition, appointment or succession of the management body and the administrative or supervisory body should also be ensured. Without prejudice to the rights of shareholders, this should, as far as possible, prevent a situation where too many members have to be replaced at the same time. The institution’s plans, policies and procedures for dealing with the sudden absence or unexpected termination of members of governing bodies, including relevant transitional provisions, should be described in the succession planning. Succession planning should reflect the institution’s diversity policy. b. Diversity in the management body and the administrative or supervisory body The nomination committee must support the administrative or supervisory body in developing objectives and strategies to promote diversity in the management body and the administrative or supervisory body.

Page 48 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act c. Assessment of the knowledge, skills and experience of the management body and the administrative or supervisory body (individually and collectively) The nomination committee must regularly, and at least once a year, support the administrative or supervisory body in the complete reassessment of the knowledge, skills and experience of both the individual members of a management body and the members of an administrative or supervisory body, as well as of each governing body collectively in accordance with section 25d (11) sentence 1 no. 4 of the KWG, and in accordance with section 25d (11) sentence 1 no. 3 of the KWG for the assessment. It participates in the development and revision of the institution’s suitability policies and is responsible for monitoring their effectiveness, reviewing their interpretation and implementation, and making recommendations for their modification, if necessary. When reassessing the management body and the administrative or supervisory body, the nomination committee is expected to take into account the following factors in particular:

• the efficiency of the working processes of the management body and of the administrative or supervisory body, including the efficiency of information flows and reporting lines, considering feedback from internal control functions and any follow￾up or recommendations of these functions,
• the effective and prudent management of the institution, including whether the management body and the administrative or supervisory body have acted in the institution’s best interests,
• the ability of the management body and the administrative or supervisory body to focus on key strategic issues,
• whether the number of meetings held, the level of attendance, the time spent and the intensity of the involvement of the members of a management body or the administrative or supervisory body during the meetings were appropriate,
• changes in the composition of the management body or the administrative or supervisory body and weaknesses in terms of individual and collective suitability, taking into account the institution’s business model and risk strategy as well as any changes in this regard,
• defined performance targets for the institution and the management body or the administrative or supervisory body,
• the independence of mind of members of the management body and of the administrative or supervisory body, including the requirement that decision-making is not dominated by individuals, and compliance with the policies for managing conflicts of interest by members of the management body and of the administrative or supervisory body,
• the extent to which the composition of the management body meets the objectives set out in the institution’s diversity policy, and
• events that could materially impact the individual or collective suitability of the members of the management body or members of the administrative or supervisory body, including changes to the institution’s business model, business strategies and organisation,

Page 49 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act

• whether there is reasonable suspicion that money laundering or terrorist financing or other financial crimes are taking place, have taken place or that attempts have been made to commit these crimes, or that there is an increased risk of this happening, including negative findings by internal or external auditors or the competent authorities regarding the adequacy of the institution’s systems and controls for combating money laundering and terrorist financing. The reassessments must be documented, including the reason for them, together with their results and any recommendations regarding the identified weaknesses. In addition, the measures taken following the reassessment must also be documented. BaFin and the Deutsche Bundesbank may require submission of the documentation (section 44 (1) sentence 1 of the KWG). The nomination committee is expected to inform the management body and the administrative or supervisory body of the results of the assessment, even if no changes to the composition or other measures are recommended. d. Review of the management body’s principles for the selection and appointment of persons at the senior management level In accordance with section 25d (11) sentence 2 no. 5 of the KWG, the nomination committee must support the administrative or supervisory body in reviewing the management body’s principles for the selection and appointment of persons at the senior management level and in making corresponding recommendations to the management body. BaFin considers persons at the senior management level to be key function holders. The procedures for selecting and appointing key function holders are expected to be set out in the suitability policies. The suitability policies may include the positions whose holders are considered to be other key function holders under a risk-based approach. VI. Measures against members of an administrative or supervisory body If a member of an administrative or supervisory body
• is not or is no longer reliable,
• does not or no longer possesses the necessary expertise,
• does not devote sufficient time to the performance of their duties, or
• breaches the rules on the incompatibility or maximum number of mandates,, BaFin may require the dismissal of this person and prohibit them from performing their activities in accordance with section 36 (3) sentence 1 of the KWG. Both measures may be taken separately or, if necessary, simultaneously. A demand for dismissal or a prohibition on activities may also be considered
• if the person has failed to detect material breaches of the principles of proper business management by the undertaking due to negligent exercise of their oversight

Page 50 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act and control functions and continues this negligent behaviour despite a warning from BaFin, or

• the person has not taken all necessary steps to remedy identified breaches and continues to fail to do so despite a warning from BaFin. This applies in equal measure to members of a voluntary supervisory body and to members of advisory boards that are equivalent to administrative or supervisory bodies (see definition of an administrative or supervisory body). BaFin may also take measures against members of an administrative or supervisory body who are members by virtue of their office and against members of an administrative or supervisory body who belong to an administrative or supervisory body as employee representatives. A BaFin demand for dismissal is addressed to the undertaking, represented by its authorised representative body, which is usually the management board. The undertaking must ensure that the measure is implemented by taking the necessary steps, such as convening a general meeting to adopt the necessary resolutions. The relevant provisions of company law and co￾determination law apply. As a rule, the body responsible for appointing members of supervisory bodies is also responsible for their dismissal. In the case supervisory board members representing shareholders (shareholders, partners or members of a cooperative), this is the general meeting, shareholders’ meeting, general assembly or representative assembly; for employee representatives and trade union representatives on the supervisory board, however, it is the employees’ assembly or the delegates it has elected. The prohibition on exercising activity as a member of an administrative or supervisory body is addressed to the administrative or supervisory body itself. If a member of an administrative or supervisory body breaches the rules on the incompatibility or the maximum number of mandates, BaFin will first give them an opportunity to restore compliance with the law by relinquishing one or more mandates. If the person does not take advantage of this opportunity, BaFin will simultaneously demand the dismissal of the person from all undertakings within the scope of the KWG at which the person holds mandates. If a person holds mandates in several administrative or supervisory bodies, a supervisory measure issued against that person may give rise to a demand for the person to be dismissed from the other undertakings or for the person to be prohibited from exercising their activities. Under the same conditions as for a demand for dismissal or a prohibition of activity, BaFin may appoint a special representative and transfer to them the duties and powers of one or more members of an administrative or supervisory body of the administrative or supervisory body as a whole, see section 45c(2) no. 3 of the KWG. The powers of the governing body or member whose powers have been assumed in full by the special representative are suspended during the assignment of the special representative. If it appears sufficient to

Page 51 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act achieve the purpose, BaFin may limit itself to transferring only some of the powers of the member of an administrative or supervisory body to the special representative.

Page 52 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act 2 Information on data protection General information on how BaFin processes data in order to meet its legal obligations related to notifications of intention to appoint can be found on BaFin’s website https://www.bafin.de/dok/7844610 under BaFin/Data protection/Information on data processing. Specific information on data processing when notifying the intended appointment of members of management bodies and members of administrative or supervisory bodies can be found here: https://www.bafin.de/ref/19606198 and https://www.bafin.de/ref/19606286.

Page 53 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act 3 Annex I – Definitions As a general rule, the terms used and defined in the KWG and Regulation (EU) No. 575/2013 (hereinafter referred to as the “CRR”) have the same meaning in this Circular. The following definitions apply for the purposes of this Circular. Please refer to the general information at https://www.gesetze-im-internet.de/ regarding the linked legislation. Family relationship Relatives within the meaning of section 11 (1) No. 1 of the German Criminal Code (Strafgesetzbuch – StGB): Persons who are directly related or related by marriage; spouses, civil partners within the meaning of the German Act on Registered Civil Partnerships (Lebenspartnerschaftsgesetz), fiancé(e)s, siblings, spouses or civil partners of siblings, siblings of spouses or civil partners, even if the marriage or registered civil partnership that established the relationship no longer exists or if the family relationship or relationship by marriage has ceased to exist; foster parents and foster children. Supervisory mandate Mandate on an administrative or supervisory body Qualifying holding A direct or indirect holding in an undertaking which represents 10% or more of the capital or of the voting rights or that makes it possible to exercise a significant influence over the management of that undertaking (section 1 (9) of the KWG in conjunction with Article 4(1)(36) of the CRR) Significant institution see section 1(3c) of the KWG. Chief Financial Officer (CFO) Person who has overall responsibility for managing all of the following activities: management of financial resources, financial planning and accounting. CRR credit institution see section 1(3d) sentence 1 of the KWG.

Page 54 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act Substitute member Person who replaces the actual member of the administrative or supervisory body if they leave permanently; see also “Alternate member”. Financial holding company see section 1 (35) of the KWG in conjunction with Article 4(1)(20) of the CRR. Members by virtue of their office Senior administrative officers, treasurers or employees in comparable positions in a regional or local authority who automatically belong to the administrative or supervisory body by virtue of their office (e.g. in the case of savings banks, the senior administrative officer; in the case of Landesbanken, the minister designated by law as responsible or the president of the savings bank association). Mixed financial holding company see section 1 (35) of the KWG in conjunction with Article 4(1)(21) of the CRR. Mixed holding company An undertaking whose parent undertaking is neither a financial holding company nor an institution or a mixed financial holding company, and whose subsidiaries include at least one institution, see Article 4(1)(22) of the CRR. Management body see section 1 (2) of the KWG. For mixed financial holding companies see section 2d of the KWG. In the case of a European Company (SE) with a unitary board structure, this refers to the executive directors on the board of directors. Group see Article 4(1)(138) of the CRR A group of undertakings of which at least one is an institution and that consists of a parent undertaking and its subsidiaries, or undertakings linked to each other by a relationship within the meaning of Article 22 of the Accounting Directive.

Page 55 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act IMAS portal Digital portal of the European Central Bank (ECB) used to submit certain fit and proper notifications electronically. Key function holder Persons who have a significant influence on the management of the institution but who are neither members of a management body nor members of an administrative or supervisory body. They include:  the heads of internal control functions and the CFO, if they are not members of a management body,  and, if identified as such by CRR credit institutions using a risk-based approach, other persons who hold key functions. These may include heads of key business lines, branches in the European Economic Area/European Free Trade Association, subsidiaries in third countries and other internal functions. Institution see section 1 (1b) of the KWG. Institutional protection scheme In Germany, the member institutions of the National Association of German Cooperative Banks have established an institutional protection scheme. The Institutional Protection Scheme of the Savings Banks Finance Group is another institutional protection scheme in Germany. Group of institutions, financial holding group, mixed financial holding group see section 10a (1) and (2) of the KWG. Senior municipal administrative officer Head of administration of a municipality, rural district or urban district, to the extent that they exercise mandates in municipal undertakings or special-purpose associations, which they are obliged to exercise by virtue of municipal regulations or statutory provisions and which are assigned solely to them. Credit institution see section 1 (1) of the KWG.

Page 56 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act Head of the internal control function/head of internal audit Persons at the highest level of the hierarchy (below the management body) who are responsible for the effective performance of the daily tasks of the independent risk control function, the compliance function and internal audit. Management mandate Mandates of as a member of a management body Less significant institution (LSI) Credit institution that is supervised directly by BaFin. Unless expressly stated otherwise, the information provided on LSIs in this Circular also applies to non-CRR credit institutions and financial services institutions supervised by BaFin (section 1 (1a) of the KWG) and (mixed) financial holding companies. Mandate Management or supervisory mandate; see definitions of those terms. Parent undertaking see section 1 (35) of the KWG in conjunction with Article 4(1)(15) of the CRR. BaFin’s Reporting and Publishing Platform (MVP Portal) BaFin’s digital portal; LSIs and their governing bodies can submit notifications about persons electronically via the “Notifications about persons”: KWG) specialised procedure. The notifications for which this submission method is currently available are published on the information page for this specialist procedure. Close relatives see section 5b (2) no. 2 of the AnzV. Member of a governing body A member of the management body or a member of the administrative or supervisory body Persons at the senior management level Persons at the management level below the management body who report to the management body. Key function holders are also persons at the senior management level. Significant institution (SI) Institutions or (mixed) financial holding companies that are directly supervised by the

Page 57 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act ECB in accordance with Article 6(4) of the SSMFR Alternate member Person who has been appointed to replace the actual member of an administrative or supervisory body in the event of short-term incapacity and who assumes their duties for that period. See also “Substitute member”. Subsidiary See section 1 (35) of the KWG in conjunction with Article 4(1)(16) of the CRR. Administrative or supervisory body A mandatory or voluntary body responsible for supervising the management body of the relevant undertaking. The decisive factor here is not the actual name of the body, but rather the rights and duties assigned to it. It is also not a mandatory requirement for the supervisory powers of the body to be regulated by law. As a result, an advisory board may also be subject to the legal requirements of the KWG if its duties and powers correspond to those of an administrative or supervisory body and are regulated by law, by the articles of association or a partnership agreement. In the case of a European Company (SE) with a unitary board structure, this refers to the non￾executive directors on the board of directors. They also serve on the committees. This does not include an audit committee in accordance with section 324 of the HGB as long as it does not perform any oversight activities beyond those specified there. Representatives of the federal government or state governments Members of an administrative or supervisory body representing the Federal Republic of Germany or one of its federal states, to the extent that the mandate of the person or the political function they hold is assigned by law or articles of association.

Page 58 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act 4 Annex II: Examples of how mandate restrictions are counted Note: Boxes with a grey background indicate mandates that count towards restrictions. Example 1: section 25d (3) sentence 3 no. 1 of the KWG (member of the same group under Article 4(1)(138) of the CRR): Example 2: Option for one management body and two administrative or supervisory body mandates subject to strict mandate restrictions Person A Administrative or supervisory body mandate 1 (group X) SB Institution X1 SB Institution X2 SB Institution X3 SB mandate 2 SB Undertaking P SB mandate 3 SB Undertaking Q

Page 59 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act Example 3: Combining management body and administrative and supervisory body mandates Person B MB mandate 1 MB Undertaking P SB mandate 1 (group X) SB Institution X1 SB Institution X2 SB Institution X3 SB mandate 2 (group Y) SB Institution Y1 SB Institution Y2 Person C MB mandate 1 (group X) MB Institution X1 SB Institution X2 SB Institution X3 SB mandate 1 SB Undertaking R

Page 60 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act Example 4: section 25d (3) sentence 3 no. 3 of the KWG (mandates in undertakings in which the institution holds a qualifying holding) Person E SB mandate 1 SB Institution C (qualifying holding in C1 and C2) SB mandate 2 SB Undertaking C1 SB Undertaking C2 SB mandate 3 SB Institution G Person C MB mandate 1 MB Institution A SB mandate 1 SB Institution B (qualifying holding in B1 and B2) SB mandate 2 SB Undertaking B1 SB Undertaking B2

Page 61 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act

Page 62 Circular on the Members of the Management Body and of Administrative or Supervisory Bodies in accordance with the Banking Act 5 Annex III: Overview of mandate restrictions strict = strict mandate restriction in accordance with section 25c (2) sentence 2 of the KWG or section 25d (3) of the KWG simple = simple mandate restriction in accordance with section 25c (2) sentence 1 of the KWG or section 25d (3a) of the KWG -- = No rule or criterion on its own is sufficient for an assessment Person is a member of a management body Person is a member of an administrative or supervisory body Obligation to establish committees (KWG only) CRR credit institution significant strict strict Yes CRR credit institutions, not significant simple simple depending on size, internal organisation, and nature, scale, complexity and riskiness Institution, non-CRR CI, significant strict simple Yes Institution, non-CRR CI, not significant simple simple depending on size, internal organisation, and nature, scale, complexity and riskiness Mixed financial holding company, superordinate

strict section 25d (3) sentence 2 of the KWG Yes Mixed financial holding company, not superordinate -- simple depending on size, internal organisation, and nature, scale, complexity and riskiness Mixed financial holding company superordinate

strict section 25d (3) sentence 2 of the KWG Yes Mixed financial holding company not superordinate

depending on size, internal organisation, and nature, scale, complexity and riskiness If strict mandate counting applies to one of several mandates, this must be applied to all mandates.