MVP-Portal — registering and filing with BaFin

Germany’s most modern reporting portal still needs you to own a printer. The MVP-Portal — BaFin’s Melde- und Veröffentlichungsplattform — is the electronic counter for the supervisory procedures whose filing is prescribed by German law, from transaction reporting to payment-incident notifications. Registering on it takes minutes. Being allowed to file through it takes an application that is generated as a PDF, signed on paper and returned to BaFin, and until that application is accepted the reports a firm sends may be sitting in the system with no legal effect at all. This piece sets out the two-step access model, the four application statuses and what each does to a provisional report, the web-form and SOAP filing routes, and how to read what comes back.

1. What the MVP-Portal is

The MVP-Portal is BaFin’s own platform for Fachverfahren — the individual supervisory procedures for which a law or regulation prescribes electronic reporting. It sits at portal.mvp.bafin.de and bundles more than fifty of them across banking, insurance, securities and investment supervision: ad-hoc disclosures and insider information under the Market Abuse Regulation, transaction reporting under MiFIR and EMIR, fund reporting, notifications of management and board personnel, outsourcing arrangements, resolution planning, prospectus filings, Solvency II returns, voting-rights notifications, suspicious transaction reports, and payment-incident reporting under PSD2.

The point most often missed by firms new to Germany is that MVP is not the country’s only reporting channel. Statistical and prudential collections run by the Deutsche Bundesbank travel through the Bundesbank’s own ExtraNet, not through MVP. The dividing line is institutional rather than topical: MVP is the counter for what BaFin collects. A German reporting map that has only one channel on it is incomplete, and the omission tends to surface late, because each channel has its own enrolment and its own lead time.

BaFin also states that procedures currently reported through the older platform do not change by virtue of the portal existing — reports continue on the accustomed platform, and procedures are moved onto the MVP-Portal over time, each move announced separately. Scope, in other words, is checked per Fachverfahren rather than assumed.

2. Two steps: register, then apply per procedure

Access has two distinct stages, and conflating them is the commonest planning error.

The first is self-registration as a Melder. The applicant chooses whether they are registering as a natural person or as the contact person of an undertaking, supplies an email address — which becomes the primary communication channel between BaFin and the filer, and is used to confirm sensitive actions — and receives a username and password.

The second is applying for a Meldeberechtigung, a reporting authorisation, and it is granted per Fachverfahren. From “Fachverfahren beantragen” the user selects the procedure from a drop-down; everything after that depends on the procedure chosen, since each has its own mandatory fields. On confirming the application the portal generates a PDF from the entries and displays it. If nothing appears, the usual culprit is a pop-up blocker, and the portal offers a download link to open the electronic application manually.

Registration therefore says nothing about what a firm may file. A user account with no accepted Meldeberechtigung is a login, not a reporting capability.

3. The paper in the middle

BaFin’s own user manual lists a printer among the technical prerequisites for the portal, alongside internet access, a browser and an email account. The reason is straightforward: when applying for a reporting authorisation the filer is asked to print the electronically generated application and send it, signed and with the required attachments, to BaFin.

There is a faster route for the documents themselves. Besides the postal channel, the signed PDF can be uploaded in the portal — but only while the application is in the vorläufig status, reached through “anzeigen/hochladen” in the application list. The upload area has two halves: Antragsdokument hochladen accepts exactly one file, the signed application, while Anlagen zum Antrag hochladen takes several attachments at once. BaFin publishes naming conventions for these filenames and expects them to be followed.

One behaviour deserves recording in the procedure. On upload, the system confirms receipt and writes a Protokoll showing when which files were uploaded — but the filenames are renamed, and it is the names in that Protokoll, not the names on the filer’s disk, that BaFin uses to identify the documents. Any later correspondence about “the file we sent” has to quote the Protokoll name to be unambiguous.

4. Four statuses, and what each does to a provisional report

The application list shows the status of every application, and clicking the application number regenerates its PDF. Four statuses exist, and the consequential difference between them is not the label but what happens to reports already submitted.

Read down the third column rather than the first. The provisional window is genuinely useful — a firm can begin submitting before the authorisation is processed, and those submissions acquire legal effect the moment it is accepted. But the same mechanism means a rejected application silently empties the evidence: the reports do not fail loudly, they cease to exist. Anyone relying on the provisional route needs the acceptance confirmed, not assumed.

A smaller trap sits in the same screen. The data written into an application reflects the user data held at the moment the PDF is generated. If user details changed after the original filing, a regenerated document carries the current values, not the ones on the copy already signed and posted.

5. Filing: web form or SOAP

Reports reach a Fachverfahren either through the web interface or through the portal’s SOAP web service, and the portal records which route was used — the Meldeweg is a searchable attribute of every submission.

Automating requires a SOAP-compatible client and, first, an ordinary registration on the portal through the web interface: there is no API-only onboarding. Authentication against the security gateway is by username and password, with the transfer protected by SSL. Two technical constraints are non-negotiable: the encoding must be UTF-8, and the XML must be structurally valid, or the message fails before it reaches the procedure at all.

Endpoints follow a predictable shape, on port 444 — portal.mvp.bafin.de:444/services/ws/<verfahren> for the classic interfaces, with matching ?wsdl and schema URLs, and services/sp/v1/<verfahrenId> for the newer ones. Attachments are carried in the SOAP message, including as MTOM.

The detail worth building a test plan around: where a Fachverfahren has one, its test procedure is exposed as a separate web-service interface identified by a t_ prefix — t_nlp beside nlp, t_a26mifir beside the Article 26 MiFIR transaction-reporting interface. BaFin’s stated purpose for these is to let a filer send test reports so that error sources are found and fixed before real transmission begins. The same convention appears in the Protokoll, where procedure identifiers carry a T_ prefix for the test variants, so production and test traffic can be queried separately.

6. The Protokoll, the Rückmeldung and the Postfach

Three things come back, and they answer different questions.

The Protokoll answers “what did we send?”. It records the reports transmitted under a Fachverfahren and the status of each, and it is queryable both in the portal and through a dedicated web service at services/ws/protokoll. Search criteria include the procedure identifier, a submission time range, the status and the Meldeweg — which is how a firm reconstructs, months later, whether a given filing went in by web form or by web service.

The Rückmeldung answers “what did BaFin make of it?”. Feedback from the processing of submitted reports is held in the same Protokoll and retrieved by its own request, and depending on the Fachverfahren it can consist of text, an attached file, or both. This is the artefact to instrument monitoring on. A submission that was accepted by the gateway has cleared transport, not content.

The Postfach is the portal’s message box: messages are filtered by category and by read status, can be downloaded as PDF with their attachments, and can be deleted. Notification emails announcing new messages can be switched off — which is worth deciding deliberately rather than discovering after someone has turned them off for their own inbox.

7. Three scenarios

Scenario one: the reports that vanished. A firm applies for a Meldeberechtigung, starts submitting under the provisional status to meet a first deadline, and treats the submissions as done. The application is then rejected because an attachment was missing. Facts to rule: provisional reports become legally effective only on acceptance, and are removed on rejection. What the reporting lead does: track the application status as a control in its own right, chase acceptance rather than waiting for it, and treat any filing made under vorläufig as unconfirmed until the status flips. Outcome: the gap is visible while it can still be closed, instead of appearing as an unexplained absence of filings.

Scenario two: the test that was never a test. A team building an automated MiFIR feed points its client at the production endpoint and sends what it regards as sample data, intending to clean up afterwards. Facts to rule: test procedures have their own interfaces marked by the t_ prefix, and their traffic is separated in the Protokoll under T_ identifiers. What the engineer does: build against the test interface first, confirm the Protokoll shows the T_ procedure, and only then repoint to production. Outcome: nothing has to be withdrawn, and the first production message is not the first message ever sent.

Scenario three: the file BaFin cannot find. A firm uploads its signed application and three attachments, then emails a query referring to the documents by their original filenames. Facts to rule: uploaded filenames are renamed, and BaFin identifies files by the names recorded in the Protokoll. What the analyst does: after every upload, capture the Protokoll entry — timestamp and assigned names — into the case file, and quote those names in correspondence. Outcome: a one-email clarification rather than a round of reconciliation, and an audit trail that matches the regulator’s.

8. FAQ

9. What to do, today

• List the Fachverfahren your entity actually owes, and confirm for each whether it is filed through MVP or through Bundesbank ExtraNet before estimating any work.
• Separate the two access steps in the plan: registration is same-day, a Meldeberechtigung is not, and it is per procedure.
• Put the printed, signed application on the critical path. Where possible upload it in the portal while the application is provisional, rather than relying on post.
• Treat the application status as a monitored control, and never regard a filing made under vorläufig as complete until the status shows accepted.
• Capture the Protokoll entry after every document upload, including the renamed filenames, and quote those names in correspondence with BaFin.
• Build automation against the t_ test interface first, and verify the test traffic appears in the Protokoll under its T_ identifier.
• Enforce UTF-8 and schema validation in the pipeline before transmission, since malformed XML fails ahead of the procedure and produces no useful business feedback.
• Instrument alerting on Rückmeldungen, not on gateway responses, and decide deliberately who receives Postfach notification emails.
• Re-check scope periodically: procedures move onto the MVP-Portal over time and are announced individually, and obligations are also removed — the registration duties for investment advisers, distribution staff and compliance officers, and the reporting of complaints received, ended on 10 February 2026 with the Standortfördergesetz, which repealed the legal basis in § 87 WpHG and the WpHG employee notification regulation.

Related: German supervisory reporting — Bundesbank ExtraNet · Reporting channels compared across the EU · The German reporting calendar for a payment firm · Millionenkredit reporting ends in 2026