Investment firm authorisation in Germany — BaFin, the WpIG and the three IFR/IFD classes

A German investment firm is authorised by BaFin under the Wertpapierinstitutsgesetz (WpIG), and where it lands in three size classes decides its capital, its capital-adequacy regime and even whether it stays an investment firm at all. Since June 2021 Germany has run its investment firms under a dedicated act, transposing the EU investment-firm package and pulling the population out of the old banking-law regime. This piece walks through the BaFin authorisation for a MiFID investment firm — authority, legal basis, the three classes, the €75k / €150k / €750k capital tiers, the services catalogue, the file, K-factor own funds, passporting and timing — with worked examples showing how the service mix sets the class and the capital.

1. Who grants and who supervises

Anyone providing investment services in Germany on a commercial scale needs prior written authorisation from BaFin (the Bundesanstalt für Finanzdienstleistungsaufsicht) under section 15(1) WpIG. BaFin runs the authorisation and, with the Deutsche Bundesbank, the ongoing supervision — the Bundesbank handles much of the day-to-day prudential monitoring, BaFin the sovereign decisions. On grant the firm is entered on BaFin’s register and, for passported services, is visible on ESMA’s registers.

2. Legal basis

• Wertpapierinstitutsgesetz (WpIG) — the German Investment Firm Act, in force since 26 June 2021, the authorisation and prudential home for investment firms
• Regulation (EU) 2019/2033 (IFR) — directly applicable investment-firm capital regulation
• Directive (EU) 2019/2034 (IFD) — the investment-firm prudential directive, transposed by the WpIG
• Directive 2014/65/EU (MiFID II) and Regulation (EU) No 600/2014 (MiFIR) — the conduct and market-structure framework; conduct rules sit in the Wertpapierhandelsgesetz (WpHG)
• Regulation (EU) 2022/2554 (DORA) — ICT and operational-resilience obligations

3. The three size classes

The WpIG follows the IFR/IFD proportionality logic and sorts firms into three classes:

• Class 1 — large, bank-like. Firms dealing on own account or underwriting with total assets at or above €15 billion (alone or across the group) are treated like credit institutions under the CRR and, at the top, may require a banking authorisation rather than a WpIG one.
• Class 2 — medium. Firms above the “small and non-interconnected” thresholds. They compute own funds on the full K-factor methodology and carry the fuller reporting and governance load.
• Class 3 — small and non-interconnected. Firms below the IFR thresholds (assets under management, client orders handled, assets safeguarded, all under defined limits) with a lighter regime.

4. Initial capital — three tiers by service

The initial-capital floor is set by what the firm is authorised to do, mirroring IFD Article 9:

Initial capital is the entry ticket; ongoing own funds are then the higher of that floor, a quarter of the prior year’s fixed overheads, and — for Class 2 — the K-factor requirement (see §8).

5. The MiFID services catalogue

A German investment firm requests one or more of the MiFID II investment services, each of which shapes the class and capital:

• Reception and transmission of orders
• Execution of orders on behalf of clients
• Dealing on own account
• Portfolio management
• Investment advice
• Underwriting and/or placing on a firm-commitment basis
• Placing without a firm-commitment basis
• Operation of an organised trading facility (OTF) or multilateral trading facility (MTF)

Ancillary services — safekeeping and administration of instruments, granting credit to let a client transact, FX linked to investment services — are requested alongside but do not by themselves make an investment firm.

6. What goes in the file

• Programme of operations — the investment services and instrument types sought, target clients and geographies
• Business plan — three-year projections with capital and own-funds planning against the applicable K-factors
• Governance — at least two managers of good repute and adequate experience (four-eyes), a management body, and clear reporting lines
• Capital proof — evidence of the paid-up initial capital at the correct tier
• Internal control — risk management, compliance and internal audit proportionate to the class
• ICT and resilience — a DORA register of information and outsourcing controls
• AML/CFT — programme under the Geldwäschegesetz (GwG), with a money-laundering reporting officer and goAML reporting to the FIU (see the German SAR piece)

7. Worked example — a robo-adviser choosing its tier

Facts: a firm plans discretionary portfolio management and investment advice for retail clients through an app. It routes all execution and custody to a third-party broker and custodian, and never holds client money or securities itself. It wonders whether it faces the €75,000 or €150,000 floor.

What the rule says: portfolio management and advice, where the firm is not permitted to hold client money or securities and does not deal on own account, sit in the €75,000 tier. Because it holds no client assets and handles limited order flow, it is a strong candidate for the small-and-non-interconnected Class 3 regime — lighter own-funds and reporting.

What the practitioner does: confirms in the authorisation application that it neither holds client assets nor deals on own account, files at €75,000, and models Class 3 own funds as a quarter of fixed overheads. It keeps a watch on the interconnectedness thresholds: if it later takes custody or its assets-under-management climb past the IFR limits, it re-tiers to €150,000 and Class 2.

8. Worked example — a firm that starts dealing on own account

Facts: an execution broker authorised at €150,000 launches a market-making desk, quoting two-way prices in ETFs from its own book to improve fills.

What the rule says: dealing on own account triggers the €750,000 initial-capital floor and brings the “risk-to-market” and “risk-to-firm” K-factors into the own-funds calculation. If its balance sheet later crosses €15 billion — alone or across a group — it tips into Class 1 and is treated as a credit institution under the CRR, potentially needing a banking authorisation.

What the practitioner does: applies to extend its authorisation to dealing on own account before the desk goes live, tops initial capital to €750,000, and rebuilds its own-funds and IFR reporting around the K-factors. It sets an internal balance-sheet alarm well below €15 billion so the Class 1 reclassification is planned, not discovered by the supervisor.

9. K-factor own funds and reporting

Under the IFR, a Class 2 firm’s own-funds requirement is the highest of its fixed-overheads requirement, its permanent minimum (the initial-capital floor) and its K-factor requirement. K-factors quantify risk to clients (assets managed, client money held, assets safeguarded, client orders handled), risk to market (net position risk, clearing margin), and risk to the firm (trading counterparty default, daily trading flow, concentration). Firms report own funds, concentration and liquidity to BaFin and the Bundesbank on the IFR schedule; Class 3 firms report a reduced set. The reporting templates are the investment-firm analogue of the banking COREP returns.

10. Passporting

A German MiFID authorisation passports across the EEA. The firm notifies BaFin of the host states and services, BaFin transmits to the host authority, and the firm may then serve clients on a Freedom of Services basis or through a branch. The passport covers the investment services in the authorisation — not ancillary activities that fall outside MiFID.

11. Realistic timing

BaFin has six months from a complete application to decide (and must decide within twelve months of receipt regardless). As everywhere, “complete” is the operative word: the clock effectively runs from when BaFin has what it needs, and question rounds extend the dialogue. A realistic first-time timeline, including pre-submission engagement and drafting, is nine to twelve months. Filing in German is the norm; early contact with BaFin’s market-access team helps calibrate the class and capital before the file hardens.

12. Germany against the other MiFID jurisdictions

The IFR/IFD capital tiers are identical across the EEA — the differences are procedural: Germany’s twin BaFin/Bundesbank split and German-language filing, France’s AMF/ACPR division of labour, and Spain’s single-authority CNMV route. The class and K-factors travel with the firm wherever it bases.

13. What switches on at grant

• MiFID passport notifications to host EEA states — branch or Freedom of Services
• IFR own-funds, concentration and liquidity reporting to BaFin and the Bundesbank
• MiFIR transaction reporting of executed transactions to BaFin
• AML reporting under the GwG through goAML to the FIU
• DORA ICT-risk, incident-reporting and register obligations

14. FAQ

15. What to do, today

• List the exact MiFID services you need — the service mix fixes both the class and the capital tier.
• Decide whether you will hold client money or securities; that single answer moves you between the €75,000 and €150,000 floors.
• Model your K-factors early if you sit in Class 2 — they, not the floor, often drive the binding own-funds number.
• Take a pre-submission meeting with BaFin to confirm the class before drafting.
• Build the DORA register and the GwG/goAML stack at authorisation, not after launch.

Related: EMI licence in Germany · AMF MiFID II investment firm (France) · Investment firm in Spain (CNMV)