Part 1: General provisions

On section 1

Section 1 regulates the scope of the audit under the regulation with reference to section 89 of the Securities Trading Act (Wertpapierhandelsgesetz – WpHG).

The audit of the depository function in accordance with section 68 (7) of the German Investment Code (Kapitalanlagegesetzbuch – KAGB) will in future be regulated elsewhere and was therefore removed from the scope of the WpDPV. Section 68 of the KAGB now contains a new subsection (7a), which stipulates the minimum extent of the audit of the depositary function under section 68 (7) of the KAGB. Further provisions on the nature, extent and time of the audit of the depositary may be issued in a separate regulation, in accordance with section 68 (8) of the KAGB.

On section 2

In section 2, as well as the references being adjusted and updated, numbers 2 and 3 were reformulated and merged to form a new subparagraph (section 2 (3)), to give more clarity to the definition of the concept of deficiency overall. All the obligations listed in section 89 (1) sentences 1 and 2 of the Securities Trading Act which are not listed in the new subparagraph (2), and which are thus not covered by the qualitative concept of deficiency, will therefore in future be covered by sentence 1 of the new subparagraph (3) and consequently by the quantitative concept of deficiency. Sentence 2 of subparagraph (3) is to be considered merely as a catch-all provision which is to be applied in subordination to subparagraph (3) sentence 1. In particular, subparagraph (3) sentence 2 is thus to be applied when a spot check cannot be conducted for the obligations under sentence 1 of subparagraph (3) (e.g. because no transactions relating to a particular obligation occurred during the reporting period but other errors of potentially equal gravity – such as deficient work instructions – were found.)

Furthermore, subsection (4), which contains a definition of “other findings”, was newly inserted. Other findings are deemed to exist if the auditor finds that the guidance on Union law requirements (e.g. ESMA Q&As, ESMA Opinions) developed and published by the European Securities and Markets Authority (ESMA) has not been taken into account at all, or only incompletely. The definition concerning other findings was newly incorporated into this regulation so that the ESMA guidance could be taken into account appropriately in the context of the audit. Other findings within the meaning of section 2 (4) of the WpDPV do not automatically result in a conclusion that an error or a deficiency has occurred. The guidance provided by ESMA provides more detail on European legal provisions which are either directly applicable or have been transposed into national law and are to be complied with by market participants. Furthermore, the guidance developed by ESMA constitutes a tool to enhance supervisory convergence in line with Article 29(2) of Regulation (EU) No 1095/2010 (ESMA Regulation). In the Q&As it publishes, ESMA thus answers, for example, market participants’ questions regarding obligations to be complied with. As ESMA Q&As and ESMA statements in other forms serve as aids to interpretation and to provide more detail on existing statutory obligations, they have to be taken into account in the context of the audit when assessing whether the obligations incumbent on investment firms have been complied with. The auditor is not, however, supposed to conduct a separate check of compliance with ESMA guidance, in isolation from existing obligations. A check of compliance with the ESMA Q&As in the sense of a “tick box” approach is not required and not intended. The guidance developed by ESMA is, rather, always to be viewed and reviewed in the context of the respective statutory or Union law provisions. The newly inserted definition of other findings enables the auditors to declare a lack of or an incomplete regard for the guidance developed by ESMA without obliging them to simultaneously conclude that an error or deficiency has occurred. The description of the lack of or incomplete regard for the guidance developed by ESMA in the audit report and in the questionnaire to be submitted with the report is intended to enable BaFin to determine conclusively whether this is to be deemed a deficiency. This means that, the guidance developed by ESMA, insofar as it is applicable from BaFin’s point of view, can be appropriately taken into consideration in the context of the audit.

Part 2: Audit

On section 3

Section 3 now contains provisions on the period, duration and interruption of the audit. The content corresponds to the provisions previously contained in section 3 (2) sentences 1 to 5.

On section 4

This section contains provisions on the reporting period. The content corresponds to the provisions previously contained in section 3 (2) sentences 6 to 9.

On section 5

Section 5 now contains the provisions on the start of the audit. The content of section 5 (1) corresponds to that of the old section 3 (3) sentences 1 and 5, the content of section 5 (2), (3) and (5) to that of the old section 3 (1) sentences 1 to 4, and the content of section 5 (4) to that of the old section 4 (4).

On section 6

Section 6 stipulates general requirements for the audit and determining points of focus.
The content of section 6 (1) corresponds to that of the old section 4 (1). However, sentence 2 of the old section 4 (1), which provided further detail on the audit of safe custody business, was rescinded. The provisions applicable to audits of safe custody business will in the future be found in numbers 21 and 25 of section 11 (1) and in section 12 of the WpDPV. The provisions regarding safe custody business will be fleshed out by respective adjustments to BaFin’s administrative practice. Against this background, the details previously provided in sentence 2 are no longer required. Furthermore, sentence 3 of the old section 4 (1), which contained provisions on the audit of depositaries, was rescinded as the audit of depositaries will in future be conducted in accordance with section 68 (7a) of the KAGB (cf. explanatory note on section 1).

Section 6 (2) contains the provisions of sentence 2 of the old section 2 (1). The provisions stipulate that the auditor is to exercise due discretion in assessing compliance with the obligations contained in sentences 1 and 2 of section 89 (1) of the Securities Trading Act. In doing so, the auditor is bound by the guidance issued by BaFin in guidelines, circulars, announcements, notices and other publications. Furthermore, the auditor is to take into account the guidance developed and published by the European Securities and Markets Authority on Union law requirements (e.g. ESMA Q&As, ESMA Opinions and other ESMA statements), insofar as BaFin considers it to be applicable (cf. explanatory note on section 2 (4)). As a rule, it is to be assumed that BaFin considers such guidance to be applicable unless it issues an explicit statement to the contrary.

Subsections (2) to (5) of section 6 essentially contain the provisions of sentences 1 to 4 of the old section 4 (1). These subsections regulate the determination of points of focus by the auditor in some parts of the investment services and ancillary services rendered and the minimum extent of audit activities in the parts where the auditor does not determine a point of focus. The audit is to be conducted comprehensively in all parts. If the auditor decides on a more thorough audit in some parts by determining points of focus, audit activities must not be missed out in parts where no points of focus have been determined. System checks including tests of controls and spot checks conducted at the auditor’s duly exercised discretion are set as the minimum standard for the intensity of audit activities in the parts where the auditor has not determined points of focus. In audit practice, audit activities in all parts were not implemented consistently in the past.

Insofar as system checks including performance tests and spot checks conducted at the auditor’s duly exercised discretion are carried out, the organisational arrangements of the investment firm, in particular the organisational and operational structure and the organisation’s internal controls are to be audited. The system check is to establish whether the organisational arrangements of an investment firm are set up to ensure that the schedule of obligations is complied with. The performance test is to find out by way of an example how the organisational arrangements are implemented in an individual real-world or fictitious case. In a spot check, the auditor chooses specific real-world cases, on the basis of the risk, that enable them to assess the examined audit area with reasonable certainty.

The conclusion that no obvious indications exist for significant organisational changes or negative deviations in comparison with the previous audit is not sufficient as an audit activity. In this respect, an auditor may not, in particular, restrict themselves to conducting interviews with employees of the investment firm which would lead to precisely that conclusion.

Organisational arrangements are instead to be examined by conducting independent audit activities, in particular by reading the instructional material. In doing this, the auditor is also to take into account control results of the internal control system, the compliance function and the internal audit. Furthermore, auditors are to include in their audit facts and circumstances pointed out to the institution by BaFin or by other supervisory authorities insofar as the facts and circumstances are relevant to the WpHG audit. Insofar as the auditor in the previous audit did not find any deficiencies in the audit area to be examined, the supervisory legal framework and the work instructional material are unchanged from the previous audit, and the internal control results and the findings from the supervisory authorities’ measures did not result in any notable objections, it is not essential for the auditor to conduct additional audit activities.

In individual audits, specific real-world cases are examined. The extent of these audits must be sufficient to enable the auditor to assess the examined audit area with reasonable certainty.

On section 7

Section 7 stipulates provisions for the audit of branches, branch offices, local offices and outsourced procedures and activities. The content of the section corresponds to that of the old section 4 (3).

On section 8

This section regulates the extent to which the auditor is to take into account special audits in accordance with section 88 (1) of the WpHG in the context of the standard audit in accordance with section 89 (1) sentences 1 and 2 of the WpHG. The provisions correspond to the content of the old section 4 (3a).

On section 9

Section 9 contains provisions on the records to be kept by the auditor and the documents the auditor may take with them in the context of the audit. The provision corresponds to the old section 4 (5).

Part 3: Audit report and questionnaire

On section 10

Section 10 regulates the scope of reporting. The content of subsections (1) and (2) corresponds to that of the provisions of the old section 5 (1). The content of section 10 (3) corresponds to that of sentence 10 of the old section 3 (2).

On section 11

Section 11 contains a list of the elements to be presented in the audit report. The content of this section essentially corresponds to subsections (1) and (2) of the old section 6. However, the provisions were revised and updated in terms of wording and content to bring them in line with obligations for investment firms that now arise partly from European regulatory law and with part 11 of the Securities Trading Act, which has been renumbered and adapted to the Directive. In the process, some provisions were rescinded: the information on the percentage share of client orders that were based on investment advice in relation to the total number of client orders irrespective of whether they were based on investment advice or not, and the ratio calculated from the share of employees in the compliance function in relation to the relevant persons in the investment firm.

On section 12

Section 12 now regulates the provisions for the audit of safe custody business, complementing section 11 (1) numbers 21 and 25. The content of section 12 essentially corresponds to that of the old section 6 (3). The provisions in section 11 (1) numbers 21 and 25 and in section 12 take into consideration the new provisions of section 84 of the WpHG and of section 10 of the WpDVerOV as well as the provisions from Articles 49 and 63 of Commission Delegated Regulation (EU) 2017/565.

On section 13

Section 13 contains provisions on the presentation of audit activities, particularly with regard to points of focus for the audit determined by BaFin and by the auditor. The provisions broadly correspond to those of the old section 5 (2).

On section 14

Section 14 regulates references to the content of previous audit reports. The content of the section essentially corresponds to that of the old section 5 (3).

On section 15

Section 15 contains provisions on the presentation of the remedying of deficiencies identified during the previous audit. The content of this section corresponds to that of the old section 5 (4).

On section 16

Section 16 contains the provisions of sentences 1 and 2 of the old section 5 (5) and stipulates that the auditor must present the result of the audit in a concluding summary.

On section 17

Section 17 contains formal provisions and corresponds to the content of sentences 3 and 4 of the old section 5 (5).

On section 18

Section 18 contains provisions for the questionnaire that is to be submitted in accordance with section 89 (2) sentence 2 of the WpHG. Section 18 (1) corresponds to sentences 1 and 2 of the old section 5 (6).

On section 19

This section regulates the submission of the audit report to be compiled by the auditor and of the questionnaire which is to be submitted in accordance with section 89 (2) sentence 2 of the WpHG. The content of the section essentially corresponds to that of sentences 2, 3 and 5 of the old section 3 (3). However, adjustments were made which were necessitated by corresponding amendments in section 89 (2) of the WpHG. Due to one such change, audit reports will in future only need to be submitted at BaFin’s request. The questionnaire must, as before, be submitted without undue delay even in the absence of such a request. To support efficient and risk-oriented supervision, the audit report and the questionnaire, including the description of the identified deficiencies, are in future always to be submitted electronically to BaFin, using BaFin’s Reporting and Publishing Platform (MVP), to facilitate a faster and more efficient evaluation of the questionnaires. Furthermore, section 19 (3) has been added to set a deadline for the submission of the audit report, as it no longer has to be submitted without undue delay once the audit is completed, but only on request. BaFin may choose not to require the submission of the questionnaire in written form from any of the parties subject to the obligation to submit.

On section 20

This section contains provisions on sending the draft report to BaFin. The content of this provision corresponds to sentences 2 and 3 of the old section 5 (7).

On section 21

Section 21 corresponds to sentence 1 of the old section 5 (7) and stipulates that the auditor must explain the audit report to BaFin at its request.

Part 4: Final provisions

On section 22

Section 22 contains information about the entry into force of the WpDPV and the repeal of the old WpDPV.

On the annex

The content design of the questionnaire in the annex was adapted in terms of wording and content to the amended and added obligations of the Securities Trading Act and the European regulations for which auditing is required under the WpDPV. It also takes into account the additional detail regarding individual obligations provided by European delegated acts, including in the form of regulatory technical standards, which are included in the table for the relevant obligations where they provide additional detail on the obligations. Furthermore, a new category for the audit conclusions (“category 4”) was added to show other findings relating in particular to a lack of or incomplete regard for the guidance published by ESMA, e.g. in the form of ESMA Q&As. The audit activity in the context of the newly introduced category 4 is of a qualitative nature. Other findings are only presented in the context of the audit of compliance with specific obligations. However, there are no checks separate from an existing obligation to examine whether ESMA’s guidance on provisions is being complied with in every individual case. The description of deficiencies in the questionnaire (field no. 51) enables BaFin to see the extent to which statutory and Union law obligations are not or not completely complied with, taking into account the guidance on legal norms issued by BaFin or by ESMA (e.g. in the form of ESMA Q&As), and, on this basis, to request submission of the audit report conduct its own evaluation.

Dealing with annual WpHG audits covering both the old legal situation under MiFID I and the new legal situation under MiFID II

In cases where the reporting period ends on or before 2 January 2018, the auditor may submit the old questionnaire.

In cases where the reporting period extends beyond 2 January 2018, the audit must cover both compliance with the old legislation and compliance with the new legislation arising from the implementation of MiFID II.

In this case, the auditor is to submit the new questionnaire. Where audited matters are assessed under the old legislation, the auditor should identify the respective audit findings in the audit fields of the applicable audit areas.

In such cases, it is not necessary for parts of the audited investment services and ancillary services to be covered twice in the questionnaire. A part is to be listed (once) as a deficiency in the questionnaire if a deficiency is deemed to have occurred under either the old legislation or the new legislation or under both the old and the new legislation.

Should audit areas that were contained in the questionnaire that had to be completed in the past not be included in the new questionnaire, conclusions and other findings are to be given in field number 52 of the questionnaire (“Further conclusions relevant to the assessment of compliance for investment services rendered”). This also applies to audit areas for which the underlying obligation is no longer maintained in its previous form (e.g. investment advice minutes).