LeasAG muss ordnungsgemäße Geschäftsorganisation sicherstellen

The deficiencies span organisational structure and processes, risk-bearing capacity, risk controlling, compliance and internal audit — core elements of the governance framework that supervisors expect financial institutions to maintain. The order became final on 5 October 2026, underscoring that BaFin will escalate from audit findings to formal remediation requirements when weaknesses are repeated or material. For compliance and risk teams, the case is a reminder that §25a KWG obligations are not limited to policies on paper: they require demonstrable board oversight, an effective control environment, adequate risk capacity, independent risk control and a functioning internal audit function.

Firms should treat audit findings on these topics as supervisory signals, not administrative items. Action points: map current governance arrangements against §25a(1) KWG expectations; test whether risk-bearing capacity and risk-controlling processes are documented, current and used in decision-making; confirm compliance and internal audit have sufficient independence, resources and escalation routes; track remediation to evidence and board-approved closure. The direct effect is limited to LeasAG, but the precedent is broader: similar deficiencies can trigger formal orders, intensified supervision and reputational damage.

Institutions preparing 2026 audits should pre-empt repeat findings and ensure remediation is evidenced before supervisory follow-up. RegCanary recommends board-level review of open audit issues and a readiness check for business-organisation examinations.