Germany’s BaFin Fines Deutsche Bank €8 Million Over Postbank IT Migration Failures

Key Takeaways

• €8 Million in Fines: Germany’s BaFin imposed administrative fines totaling €8 million on Deutsche Bank on November 11, 2026, for violations of the Securities Trading Act connected to its 2023 Postbank IT migration.
• Complaint-Handling Failures: A €5.5 million penalty concerns the bank’s failure to establish adequate arrangements for promptly processing increased customer complaints during Project Unity.
• Delayed Securities Transfers: BaFin imposed a further €2.5 million fine after finding that Deutsche Bank failed to execute securities account transfer orders without delay.
• Organizational Requirements: Sections 80(1) and 69(1) of the WpHG establish obligations concerning the organization of investment services, complaint handling and timely execution of customer orders.
• Three-Week Transfer Limit: Securities account transfers must be executed without delay and completed within three weeks at the latest.

Deep Dive

Deutsche Bank has been fined €8 million by Germany’s financial regulator for failing to handle customer complaints promptly and delaying securities account transfers during the migration of Postbank customers to its shared IT platform in 2023.

The Federal Financial Supervisory Authority (BaFin) cited violations of the German Securities Trading Act (WpHG). The shortcomings arose during Project Unity, the bank’s effort to move Postbank customers onto its parent company’s IT infrastructure.

Of the €8 million total, €5.5 million relates to the bank’s failure to establish adequate arrangements for handling a surge in customer complaints. The remaining €2.5 million concerns delays in transferring securities accounts, a service that German securities law requires investment firms to carry out without delay.

The findings concern two obligations that remained in force throughout the migration. Deutsche Bank was required to maintain arrangements capable of handling complaints promptly, even as their volume increased, and to ensure that customer instructions to transfer securities accounts were executed within the prescribed timeframe.

Failures in Complaint Handling and Securities Transfers

The larger penalty stems from Deutsche Bank’s handling of complaints during the 2023 migration. As Postbank customer data was transferred, complaints increased. BaFin found that the bank had failed to put appropriate organizational arrangements in place to deal with the additional volume promptly.

Under Section 80(1), sentence 2, no. 1 of the WpHG, investment services firms must maintain adequate organizational arrangements to ensure that their services are provided properly. The provision also requires firms to minimize delays in identifying and remedying disruptions to business operations, including through arrangements that allow customer complaints to be addressed without delay. BaFin concluded that Deutsche Bank had fallen short of those requirements.

The second violation concerned securities account transfers. Section 69(1) of the WpHG requires investment services firms to establish arrangements for executing customer orders without delay. That obligation extends to instructions to transfer securities accounts, which must be completed within three weeks at the latest.

According to BaFin, Deutsche Bank failed to execute such orders promptly during the migration. The regulator did not disclose how many customers were affected, the number of complaints received or the length of individual transfer delays. Its findings establish deficiencies in the bank’s organizational arrangements and its execution of customer orders, rather than a quantified account of the disruption experienced by customers.

Obligations That Survive an IT Migration

Project Unity involved bringing Postbank customers onto Deutsche Bank’s shared IT platform, a process that placed additional demands on the bank’s customer-service operations.

German securities law requires investment services firms to maintain arrangements that allow them to meet their obligations when those demands increase. The requirements cover both the handling of operational disruptions and the execution of customer instructions.

In Deutsche Bank’s case, BaFin identified shortcomings in both areas. The bank had not adequately prepared to process the increased volume of complaints, and customers seeking to transfer securities accounts faced delays in the execution of their orders.

BaFin is authorized to impose administrative fines when investment services firms violate the organizational requirements of the WpHG. The maximum fine for each violation is €5 million or up to 10% of a company’s total revenue. The regulator divided Deutsche Bank’s €8 million penalty between the two violations, with the complaint-handling deficiencies accounting for more than two-thirds of the total.

The fines were imposed more than three years after the problems occurred. BaFin’s announcement did not specify whether Deutsche Bank had contested the findings or whether the regulator had required additional remedial measures. The decision holds the bank accountable for failures in services it was legally required to maintain while moving Postbank customers to its shared technology platform.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey