In 2017, BaFin concluded its market investigation into payment protection insurance and identified shortcomings in the process (see info box "Focus on payment protection insurance" ).

As BaFin found in its market investigation, payment protection insurance is generally offered as an option when a consumer loan agreement is entered into, and take-up is not mandatory. Approximately two thirds of the banks surveyed indicated that the number of consumer loan agreements without payment protection insurance tended to exceed the number of loans granted with such a policy. However, one third of the institutions sell most of their consumer loan agreements with payment protection insurance. Consumers may get the impression that the loan agreement is conditional on taking out payment protection insurance.

The investigation also revealed that the commission the insurance undertakings pay to the credit institutions is sometimes very high: 12 credit institutions said they received less than 50 percent of the insurance premium. At another 12 banks, the maximum rate of commission was 50 percent, while 7 institutions received more than 50 percent. In a few isolated cases, the commission exceeded 70 percent.

Moreover, the investigation demonstrated that the contract features of payment protection insurance are difficult to understand for consumers. This is because, in many cases, the policyholder is the bank which also brokers the insurance policy rather than the customer. In the absence of explicit legal provisions, this leads to a situation where the obligations to provide information and advice to customers do not apply and customers do not have the right to cancel or withdraw from the policy. Ultimately, this means that the undertakings only provide information and only allow consumers to cancel or withdraw from agreements on a voluntary basis. The investigation also revealed that the respective provisions in the general terms and conditions of the banks and insurance undertakings vary greatly – if they exist at all.

This prompted legislators to add legal requirements for more advice, information and transparency for payment protection insurance policies to the German Insurance Contract Act (Versicherungsvertragsgesetz). However, the new regulations only entered into force on 23 February 2018.

New regulations in the Insurance Contract Act

Under section 7d of the Insurance Contract Act, the bank as the policyholder of a group contract of insurance is now subject to the obligations of an insurance undertaking to advise and inform the customer as the person insured. In addition, the customer as the insured person receives the rights of a policyholder, especially the right of revocation. This gives customers the option to review whether they really need payment protection insurance, and to do so after entering into the agreement. If not, the Insurance Contract Act allows them to withdraw from the corresponding contractual agreement for payment protection insurance. In addition, there are legal requirements for the group insurance contract under which the customer as the person insured must again be reminded in text form of this right to withdraw from the contract one week after the policy declaration has been submitted. When this information is provided, the bank must also make another copy of the product information document available to the customer. This ensures that the customer has ready access to all the important information on the payment protection insurance policy.

Moreover, legislators have put similar regulations in place in section 7a (5) of the Insurance Contract Act for those cases where payment protection insurance is offered as a by-product or as part of a package or of the same agreement, and where the customers themselves are policyholders. Here, too, the insurance undertaking has to inform them in text form one week after submitting their contractual agreement of their right to withdraw from the contract and also send them another copy of the product information document. With these amendments, legislators have brought the regulations into line with those of the group insurance contract.

Implementation of leading case law

In 2017, BaFin conducted a market investigation into "Observing higher court decisions on the application of civil law requirements with relevance to consumer protection". It surveyed about 100 supervised undertakings in different industries to find out how they monitor developments in case law and how, where necessary, they implement them in their own business activities. The survey covered private banks, savings banks, cooperative banks, Bausparkassen, financial services providers and asset management companies.

The investigation specifically looked into the extent to which the undertakings had set up regular processes for monitoring case law and how they deal with the insights gained.
All the enterprises surveyed said that they actively and systematically monitored developments in case law. In doing so, the undertakings normally make use of several sources of information, such as the daily press, the trade press, court or consultancy firm newsletters as well as training events and seminars. Associations also support their member institutions by providing circulars or forms. In addition, the undertakings explained in detail what processes they have in place for cases where court rulings are considered relevant to their own business activities. Many undertakings described cases where, in response to court rulings handed down, they made adjustments to the forms used, for example, or to lists of prices and services or business processes.

Internal control systems in banks and savings banks

In 2017, the focus of the ongoing supervision of banks and savings banks was on a market investigation into the internal control systems (ICS) of the institutions. BaFin asked over 110 institutions in writing to provide detailed information on the systems and specific controls in the areas of client advice, client information, client order processing and complaints handling. BaFin corroborated the survey results by conducting on-site interviews and reviews at over 40 institutions. One of the aims of the investigation was to get an overview of how the internal control systems work in practice.

Overall, all the institutions surveyed had well-functioning control systems and controls in the business areas under investigation. Shortcomings were only identified in isolated cases: in the review of contacts with clients and business transactions, in the comprehensibility of control activities, in the coordination of control activities of different organisational units, in the transparency of the control status or in the implementation of the escalation procedure. BaFin discussed these isolated instances in detail with the institutions concerned and the associations.