BaFin Fines Deutsche Bank €8 Million Over Postbank IT Migration

Germany’s Federal Financial Supervisory Authority (BaFin) imposed administrative fines of €8 million on Deutsche Bank AG on November 11, 2026, over failures in the 2023 migration of Postbank customers to the group’s shared IT platform.

The BaFin Deutsche Bank fine has two parts. BaFin set €5.5 million for processing customer complaints too slowly and €2.5 million for delays in transferring securities accounts, and said the bank contravened the German Securities Trading Act (WpHG).

For compliance and risk teams at banks, the decision shows how a supervisor treats the aftermath of a large systems migration. Complaint handling and the timely execution of customer orders are organizational duties under securities law, and BaFin fined each failure separately.

BaFin Deutsche Bank fine: what the regulator found

BaFin said that in 2023 Deutsche Bank failed to put in place appropriate organizational arrangements to deal promptly with the increased volume of customer complaints arising from the migration of customer data. The bank also failed to execute orders for the transfer of securities accounts without delay.

The shortcomings arose in the move of Postbank customers onto the parent company’s shared IT platform, known as Project Unity. BaFin published the notice on November 12, 2026.

The notice is brief. It does not give the number of complaints or delayed transfers, or the length of the delays. It does not say whether the decision is final or whether Deutsche Bank has accepted it.

Two WpHG duties behind the BaFin fine on the bank

BaFin tied the €5.5 million component to section 80 (1) sentence 2 no. 1 of the WpHG. The provision sets general requirements for a comprehensive compliance organization at investment services enterprises.

Under it, firms must make and implement appropriate arrangements through adequate organization to ensure the proper provision of investment services. They must also minimize delays in identifying and remedying disruptions to business operations. BaFin said this includes arrangements to deal with customer complaints without delay.

The €2.5 million component rests on section 69 (1) of the WpHG. It requires investment services enterprises to have arrangements that ensure customer orders are executed without delay.

BaFin said orders to transfer securities accounts count as customer orders. They must be executed without delay and within three weeks at the latest.

The three-week limit is the most specific yardstick in the notice. It gives firms a fixed number against which transfer backlogs can be measured during a migration.

How the fine compares with earlier BaFin actions

BaFin said it may impose a fine when a company violates the organizational obligations in the WpHG. It gave the maximum for each fine as €5 million or up to 10% of total revenue.

The €5.5 million complaint-handling component is above the €5 million figure. The notice does not say how BaFin applied the cap to that component.

The decision is not the first BaFin penalty on the bank. On December 28, 2021, BaFin imposed a fine of €8.66 million on Deutsche Bank for lacking effective controls over its input data to the Euribor benchmark, under Article 16(2)(a) of Regulation (EU) 2016/1011. BaFin later marked that order as final and binding.

On February 4, 2025, BaFin imposed fines totaling €23.05 million on the bank. Of that, €14.8 million related to currency derivatives sales, €4.6 million to telephone recording at Postbank and €3.65 million to account-switching failures.

Two of those three components also touched Postbank customers. The telephone recording fine concerned investment advice by phone, and the switching fine concerned applications under the German Payment Accounts Act that were not processed, or were processed late, in multiple cases. BaFin marked that order as final and binding.

The 2026 fine is smaller than the 2025 total. It is close to the 2021 Euribor penalty of €8.66 million.

Link to the 2023 Postbank disruptions and the monitor

The fine concerns the same 2023 period in which BaFin acted on Postbank disruptions. On September 4, 2023, BaFin published information on disruptions to business at Postbank, a branch of Deutsche Bank AG.

On September 29, 2023, BaFin appointed a special representative at Deutsche Bank over disruptions in customer service at Postbank and DSL Bank. BaFin said it acted to protect the collective interests of consumers.

The representative monitors whether the disruptions are resolved quickly and fully, reports regularly to BaFin and focuses on processing customer orders in an acceptable timeframe. The representative also works to clear the backlog of pending customer orders.

The November 2026 notice does not mention the special representative. It says the contraventions occurred in 2023, the year of the migration.

What the BaFin Deutsche Bank fine means for compliance teams

The decision applies to investment services enterprises under the WpHG. Its reasoning is not confined to one bank’s platform move.

Any firm that migrates customer data or consolidates systems carries the same duties through the change. Complaint-handling capacity must scale with the volume a migration produces, and the three-week limit on securities account transfers continues to apply while systems are being moved.

BaFin’s wording is organizational. It faulted the bank for not having appropriate arrangements in place, not for any single customer outcome. That puts the focus on staffing, escalation paths, backlog monitoring and management information that reaches senior managers and boards.

The decision also sits next to the wider push on operational resilience. The EU’s Digital Operational Resilience Act sets rules for how financial entities manage information and communication technology risk, and RegTech Post has set out the requirements in its DORA overview. The WpHG obligations in this case are separate, but both turn on how well a firm contains disruption.

The case also belongs with other bank enforcement actions where internal processes failed under strain, including the €8.5 million fine on ABN AMRO by the Dutch central bank. Teams planning large migrations can also read RegTech Post’s analysis of change management barriers.

What to watch after the BaFin Deutsche Bank fine

BaFin’s notice does not say whether the decision is final and binding. In earlier cases, the regulator added that wording to the notice once the order became final, as it did for the 2021 and 2025 fines.

Deutsche Bank’s own reporting will show whether it has accounted for the penalty. Its next set of results will be the first place to look.