Are you still fit and proper? Proposed new BaFin circular on members of the management and supervisory boards

Fit and proper (FAP) requirements are among the key requirements that apply to board members of banks and other financial institutions. Regulators have already developed comprehensive requirements and guidance on FAP requirements, both on national and on EU levels. While these requirements have existed for a while already, they continue to evolve and adapt to new challenges that institutions face, such as new ESG-related FAP requirements that will be introduced through CRD 6.

In this vein, BaFin has now published a consultation for a new FAP circular. This blogpost provides a quick overview on the key aspects of the consultation and highlights several noteworthy changes.

I. General observations

The new FAP circular combines the former BaFin circulars on members of the management board (MB) and members of the supervisory board (SB). The proposed new FAP circular shall apply to German

• credit institutions 
• financial services firms (not investment firms)
• financial holding companies

While the FAP circular will in principle be applicable to significant institutions (SIs) and less significant institutions (LSIs), BaFin notes that the fitness and propriety of board members of SIs is assessed by the ECB based on its own guidance (in particular the ECB’s Guide to fit and proper assessments). 

Interestingly, BaFin does not appear to pre-empt any FAP requirements that will be introduced with the implementation of CRD 6 into German law. Further updates of the FAP circular in the new future (transposition of CRD 6 by 11 January 2026) therefore seem likely.

II. Overview of key changes

While the FAP circular is – for the most part – a consolidated circular combining the former circulars for members of the MB and SB, BaFin does propose several noteworthy updates of its current administrative practice:

1. Knowledge requirement

A key component of the FAP test is the theoretical and practical knowledge of an individual. Regulatory law provides both for individual knowledge requirements and collective knowledge requirements that apply to the whole board. The proposed FAP circular broadens the collective knowledge requirement by requiring that the MB must in its entirety have a sufficiently broad spectrum and knowledge and experience with respect to information and communication technology. MB members must therefore regularly take part in trainings on ICT and security risks.

This new requirement directly relates to the entry into force of DORA (see our blogpost for an overview), which provides for uniform requirements concerning the security of network and information systems supporting the business processes of financial entities.

2. Time commitment 

It’s not new that members of the MB must devote sufficient time to the performance of their duties. At least for members of the MB of significant institutions, there are therefore strict limits with respect to the number of additional positions that they can hold.

BaFin now proposes to also introduce a time availability requirement for members of the MBs of LSIs, who must be able to devote at least 50 % of their time to this position. 

BaFin also expressly mentions remote working in the context of the availability of MB members. It must be technically ensured that, even in special situations requiring increased time availability, the MB has all the necessary information and communication channels at its disposal at short notice in order to be able to ensure that the proper business organisation of the institution is maintained.

BaFin’s mention of remote work may also be of importance in a different context: Remote work does not only become relevant where members of the MB work from home, but also when they work from abroad (e.g. in a branch of the institution). This suggests that BaFin may now expressly accept such practices.

3. Sanction screening

As a new component of the fit and proper test, institutions are expected to assess whether an appointee is listed on a sanctions list or has connections to a sanctioned person. BaFin expects institutions to carry out such assessment both with respect to new appointments as well as  This update follows the introduction of section 1b KWG, which provides for an assumption of unreliability of sanction persons.

4. Notification requirement in relation to FAP updates

Under section 24 KWG, institutions are already required to inform their competent authority (BaFin or ECB) and Bundesbank without undue delay about new facts that significantly affect the original FAP assessment. Article 94(1) of the SSM Framework Regulation provides for a similar requirement applicable to SIs.

BaFin now provides several examples of facts that give rise to such update requirement, which include:

• the initiation of criminal or relevant administrative investigations;
• the assumption of a chairmanship (MB, SB or committee of the SB) or a position as a member of a committee;
• a reduction of the time availability; or
• scheduled (introductory) trainings that are not carried out at all or not as originally envisaged

III. Next steps

Interested market participants can comment on the proposed FAP circular by 13 June 2025.