BaFin has not only set up a central point of contact to receive such disclosures, but has also put in place a specific procedure to provide special protection of the identity of both whistleblowers and persons affected by disclosures.

Important source of information

Disclosures about breaches of supervisory law are an important source of information for BaFin. Whistleblowers can make a valuable contribution towards uncovering misconduct by individual persons or entire companies within the financial sector as well as stemming or correcting the negative consequences of such misconduct.

In this context, supervisory law should be understood in a broad sense to mean all laws, legal regulations, general administrative acts and other provisions as well as legal acts of the European Union and the European Supervisory Authorities EBA, EIOPA and ESMA for which BaFin has the mandate to ensure compliance by the companies and persons it supervises or to investigate breaches of these.

Legal basis

The legal basis for the setting up of the contact point for whistleblowers is section 4d of the German Act Establishing the Federal Financial Supervisory Authority (Finanzdienstleistungsaufsichtsgesetz – FinDAG; only available in German), which was introduced with the First Act Amending Financial Market Regulations (Erstes Finanzmarktnovellierungsgesetz; only available in German). This transposed various European provisions into German law:

• Article 71 of the Capital Requirements Directive IV (CRD IV);
• Article 32 of the Market Abuse Regulation;
• Article 28 of the Regulation on Key Information Documents for Packaged Retail and Insurance-Based Investment Products (PRIIPs Regulation); and
• Article 99d of the UCITS V Directive.

Article 73 of the Markets in Financial Instruments Directive (MiFiD II) also envisages the establishment of a mechanism for the receipt of reports on potential or actual infringements of MiFID II provisions.

Tasks of the contact point for whistleblowers

The contact point for whistleblowers is centrally responsible for communication between BaFin and whistleblowers. It does not only accept disclosures but is responsible for any subsequent communication as well.

When it receives a disclosure, it first checks whether the disclosure is relevant for the supervisory divisions. They then examine the content and legal aspects of the disclosure. If they come to the conclusion that measures need to be taken, they will initiate them. The supervisory divisions and the contact point for whistleblowers provide each other with support in fulfilling their duties.

The contact point for whistleblowers also conducts the statistical assessment of the disclosures. From 2017 on, the result of this will be published in May each year, in the BaFin annual report.

Whistleblower protection

Section 4d of the FinDAG contains various provisions which ensure effective protection for whistleblowers and other persons affected by a disclosure. Section 4d (1) sentence 2 of the FinDAG, for example, explicitly mentions the option of making a disclosure anonymously.

However, even if they reveal their identity, whistleblowers should be able to feel confident that they will not suffer from disclosing information to BaFin. Therefore, pursuant to section 4d (3) sentence 1 FinDAG, BaFin is not allowed to make public the identity of whistleblowers without their express prior consent. It will also not reveal the identity of persons affected by a disclosure.

The need to protect whistleblowers and other affected persons is given a higher priority than the entitlement to access official information granted to everyone pursuant to the Freedom of Information Act (Informationsfreiheitsgesetz – IFG). Therefore, the IFG does not apply to whistleblowing procedures. Moreover, BaFin will only provide an abridged or summarised report of the activities of the contact point for whistleblowers in its annual report.

However, under certain circumstances, it may be necessary for other bodies, such as the relevant public prosecutor's office in the case of a criminal prosecution, to be informed of the data available so that they can continue to take action against the reported breach and, if necessary, to punish it. Pursuant to section 4d (3) sentence 3 of the FinDAG, BaFin is permitted to pass on personal data in the context of further investigations and subsequent administrative or judicial proceedings if this is required by an act or law. Courts may also order the disclosure of personal data.

Whistleblowers may not be subjected to labour law or criminal proceedings because of their disclosure or held liable for damages caused by it. This applies both to employees of companies and persons supervised by BaFin and to employees of companies to which supervised companies or persons have outsourced activities. However, this safeguard does not apply if the disclosure was intentionally or negligently untrue.

Contractual restrictions must not be placed on the right to disclose actual or potential violations of supervisory provisions to BaFin. Any such agreements are invalid.

Means of communication

Whistleblowers can find detailed information on how to make a disclosure on the BaFin website. They can choose between the following means of communication:

• in writing, by post or electronically;
• by telephone, with or without the conversation being recorded; and
• in person to a staff member of the contact point for whistleblowers.

Anonymous disclosures

If whistleblowers tell BaFin their names and reveal their professional or personal relationship to the supervised company, BaFin is able to communicate with them beyond the initial disclosure. However, there may be situations in which insiders with particular knowledge of processes in supervised companies are hesitant to provide BaFin with information out of fear of the consequences.

Yet such disclosures can be very important for uncovering and rectifying breaches of supervisory law. For this reason, it is possible to make disclosures anonymously, in particular by post or telephone. To ensure their anonymity, the whistleblowers themselves must ensure that no data which could reveal their identity, such as name and address or telephone number, are visible, e.g. on the telephone display.