Jump to main content

Corporate Compliance

Rules and processes

The sustainability strategy is specified through goals, measures, agreed rules (Code of Conduct and Sustainability Guidelines), the business strategy and instructions for process workflows (Written Fixed Rules - SFO). A Code of Conduct that supports sustainability is also included in the WFO as a binding foundational framework for all employees. Additionally, the corporate strategy, along with its goals and measures, is reviewed annually. This review process involves the relevant departments as well as the Supervisory Board.

Moreover, the goals and measures are integrated into the respective departments responsible for key areas of action (e.g., product responsibility, social responsibility toward employees). This ensures that the individual measures are implemented by the respective departments, enabling the achievement of the defined sustainability goals.

The guidelines for work processes are systematically documented in organizational management (process map) and reviewed for currency at least annually (e.g. by Internal Audit, Compliance, other departments concerned). The specialist departments are responsible for the content. Responsibility for the content lies with the respective departments. Organizational management ensures the annual update of the SFO by coordinating with the departments.

Additionally, IBB undergoes external audits conducted by independent third parties. These audits may be voluntary or mandated by law and cover all areas of sustainability. Legal audits are performed at least annually as part of the financial statement process for IBB and IBB UV. In the areas of business ethics and product responsibility, IBB may be audited internally by internal audit teams or externally by entities such as BaFin, the Bundesbank, the European Court of Auditors, or federal and state audit offices, depending on the product.

Legal and compliant behavior through compliance

In order to fulfill its responsibilities, IBB (Group) has established officer functions in the areas of Corporate Compliance, Legal and Information Compliance, and Organizational Management for the following topics.

Compliance Functions

  • The MaRisk Officer ensures compliance with the minimum requirements for risk management. This includes evaluating regulatory changes for their relevance to IBB (UV), communicating them to the respective departments if necessary, and monitoring their timely implementation. Additionally, the MaRisk Officer must be involved in significant structural and procedural organizational changes at IBB (UV) before decisions are made.

    The MaRisk Compliance function is responsible for bundling the various rules of trustful cooperation and a prudent risk culture, which are reflected in various work instructions. It also aims to raise employee awareness of potential conflicts of interest.

  • The (Group) Anti-Money-Laundering Officer coordinates the security and defense measures to prevent money laundering, terrorist financing and criminal acts. This includes potential criminal acts against IBB (UV) as well as those that could be committed by employees. Additional responsibilities include verifying the reliability of new employees and systematically reviewing customer relationships by cross-checking against sanctions lists.

  • The Capital Market Compliance Officer is responsible for ensuring compliance with legal requirements in connection with capital market transactions. These include EU directives and regulations as wells as the German Securities Trading Act (WpHG).

  • The Data Protection Officers at IBB and IBB UV monitor compliance with the General Data Protection Regulation (GDPR) and the Berlin Data Protection Act, and thus ensure the protection of the data of our customers and of our employees. Their responsibilities include establishing guidelines, conducting training, and monitoring compliance with data protection regulations based on a risk-oriented approach. They also provide advisory support to management, employees, and customers on data protection matters. Additionally, Data Protection Officers are appointed at IBT, IBB Capital, and IBB Ventures.

  • The Information Security Officer (ISO) is responsible for the planning, implementation, review and improvement of IBB's information security. The ISO advises and reports to IBB's Executive Board on information security issues. The tasks of the ISB include the implementation, operation and further development of the Information Security Management System (ISMS). This includes the development of information security policies. They also serve as the point of contact for security incidents. An ISO is also integrated into IBT, IBB Capital, and IBB Ventures.

  • The Emergency Officer evaluates regulatory requirements for their relevance to IBB and adapts central regulations and requirements as necessary. They inform and advise the Executive Board of IBB on all emergency-related incidents. As part of their second-line controls, they conduct spot checks to assess the degree of compliance with these guidelines within IBB. Additionally, they initiate the annual Business Impact Analysis (BIA), conducted by the departments, to identify time-critical processes and document various availability requirements. Emergency management aims to ensure the continuation of time-critical processes during major disruptions, thereby maintaining IBB's operational capability.

  • The Outsourcing Officer serves as the central point of contact for with regard to the specifications for service provider management. Their responsibilities include developing an appropriate outsourcing management framework with control guidelines and establishing adequate processes. They oversee the execution of both event-driven and regular risk analyses, the associated control measures, are responsible for the preparation and maintenance of comprehensive documentation for the IBB Group's outsourcing activities, and carry out the duty of disclosure to the supervisory authority.

Responsibilities and tax regulations

The Accounting Department of the Controlling and Finance Division is responsible for IBB's tax affairs. However, the department's responsibility does not extend to monitoring the tax liability of IBB's clients. IBB is exempt from trade tax and corporation tax pursuant to § 3 GewStG and § 5 KStG, so that no further monitoring is required for these types of taxes. A comprehensive internal control system is in place for all other types of taxes relevant to IBB.

Corporate Compliance at IBB

As a public financial holding company, IBB UV has a systematic process for implementing new legislation. Legislative initiatives are continuously monitored, assessed for their relevance to IBB UV, and assigned to the operational units responsible for ensuring compliance and implementation. As the development bank of the Federal State of Berlin, IBB must meet the standards and requirements set by federal and state authorities for a public-law credit institution.

In addition to the general legal regulations governing proper corporate management, IBB is also required to comply with the specific legal and regulatory provisions for public development banks as well as the administrative regulations of the State of Berlin.

For many years, IBB has consistently implemented the legal and regulatory requirements of national and European laws and regulations in its set of rules. This includes measures to combat money laundering, terrorism financing, and other criminal activities (German Money Laundering Act, Banking Act), as well as the legally compliant settlement of trading transactions (Securities Trading Act) and the prevention of prohibited securities transactions by IBB employees (Market Abuse Regulation). In order to prevent criminal acts, IBB has established a Central Office in accordance with § 25h of the Banking Act (KWG). Additionally, MaRisk Compliance plays a crucial role by ensuring, from a higher-level perspective, adherence to the key legal regulations relevant to IBB and IBB UV.

The appointed officers in the Corporate Compliance department are responsible for ensuring compliance with the relevant laws and regulations. They conduct risk-based monitoring of the operational areas of IBB and IBB UV and develop guidelines to avoid or reduce risks as well as measures to prevent criminal offenses. For each area of responsibility, a risk analysis is conducted and continuously updated to reflect changing conditions. Risk mititgating measures are implemented, and adherence to these measures is verified through control actions, which are clearly documented in a control plan. The officers report the outcomes of their work directly to the Executive Board provide advisory support on related issues.

Corporate Compliance is regularly audited both internally by Internal Audit and externally by external auditors. Corporate Compliance is subject to regular internal audits by Internal Audit department. The audit frequency is determined on an ongoing, risk-oriented basis for each audit area using an internal audit rating procedure. The regulatory requirements of MaRisk, which stipulate a maximum audit frequency of 36 months, are taken into account.

  • A core component of the corporate culture at IBB and IBB UV is the implementation of an appropriate risk culture. The key objectives of this risk culture include:

    • Anchoring a conscious approach to risks in day-to-day business in the corporate culture,
    • Establishing the risk awareness at all hierarchical levels,
    • Promoting critical dialog through management,
    • Encouraging employees to act in accordance with the value system and Code of Conduct,
    • Convincing employees to behave in an ethically and economically desirable manner and within defined risk tolerances.

    The central element of this value system is the Code of Conduct. It stands for integrity, impeccable reputation and good corporate governance. Its commitment to preventing corruption and bribery is particularly emphasized by its firm incorporation into the Code. The Code also governs the management of conflicts of interest and establishes transparent and appropriate procedures for employees in handling the acceptance of gifts and invitations, as defined in the Written Fixed Order (SFO). At least once a year, information is published on the intranet to encourage employees to familiarize themselves with the Code of Conduct.

    The Executive Board has a keen interest in compliance with the rules of the Code of Conduct.

    The MaRisk compliance function is responsible for bundling the diverse rules of trustful cooperation and prudent risk culture, which are reflected in various work instructions, and for promoting employees' awareness of potential conflicts of interest.

    Employees are proactively trained and informed about new legal regulations. The web-based training courses (WBT) for IBB and IBB UV employees on topics such as the prevention of money laundering, terrorist financing, the prevention of criminal acts and market abuse take place annually and are mandatory for all full-time and part-time employees. Additionally, employees are notified of new regulations via intranet updates. When necessary, ad-hoc or specialized compliance training sessions are provided.

    IBB and IBB UV have established mechanisms to identify, report and investigate concerns about unlawful conduct or actual conduct that is inconsistent with their Code of Conduct or similar internal rules. A breach of the Code of Conduct must be reported to the Corporate Compliance department, which handles further processing. For whistleblowing or other irregularities, reports can be made through an external Ombudsperson. In the event of customer complaints, the feedback management system ensures a standardized approach.

  • The legal provisions for the prevention of money laundering are primarily found in the German Money Laundering Act. As the laws become increasingly stricter, the requirements for IBB and IBB UV continue to rise, necessitating extensive due diligence and documentation obligations from employees.

    The internal IBB security measures resulting from the German Money Laundering Act and the Banking Act consist primarily of the implementation of customer-related due diligence obligations with regard to contractual/business partners and beneficial owners.

    Risk assessment is conducted through an annual risk analysis, which also evaluates the effectiveness and appropriateness of existing security measures.

    The (Group) Anti-Money Laundering Officer coordinates the security and defense measures to prevent money laundering, terrorist financing and criminal acts. Possible criminal acts against IBB and IBB UV as well as those that could be committed by employees must be considered. Other tasks include checking the reliability of new employees and systematically reviewing customer relationships by comparing them with sanctions lists. The review is based on United Nations resolutions, the EU issues regulations that stipulate certain sanctions. For IBB and IBB UV, various measures are taken to ensure that no assets are made available to sanctioned persons or organizations, and, if necessary, existing assets are frozen.

  • To ensure that public funds do not fall into the wrong hands, IBB and IBB UV have implemented various measures and standards to ensure legal compliance. The key components are outlined as follows:

    • Examination of suspected cases and cases of damage and forwarding to the responsible authorities (e.g. law enforcement authorities, state data protection officers, Federal Office for Information Security) in the event of reasonable suspicion.
    • Central contact persons for advising employees. For the confidential reporting of questionable incidents, IBB employees and business partners as well as any third parties can also contact an external ombudsman's office (law firm) or the Federal Financial Supervisory Authority's contact point for whistleblowers in addition to the Corporate Compliance department. This can also be done anonymously to protect the whistleblower.
    • Regular web-based training for employees on compliance issues to prevent infringements.

  • The Capital Market Compliance Officer is responsible for ensuring compliance with legal regulations in connection with capital market transactions. Key regulations include the Securities Trading Act (WpHG) as well as overarching EU directives and regulations.

    As a public development bank, IBB does not engage in capital market activities for private customers. Therefore, the Capital Market Compliance Officer does not deal with consumer protection issues but focuses on IBB’s proprietary securities trading and issuance business. The WpHG requires transparency in trading activities and mandates the communication of behavioral and organizational guidelines. This also includes raising awareness of the proper handling of any insider information that may arise and the compliant treatment of this information. Capital market compliance thus serves as a trust-building measure for capital markets and their participants.

  • Employees, business partners of IBB and IBB UV, and other stakeholders have several channels available for confidentially reporting questionable incidents. In addition to the Corporate Compliance department, reports can also be made anonymously through an external Ombudsperson (law firm) or the whistleblower contact point at the Federal Financial Supervisory Authority (BaFin). Information on these reporting options is available on both the internet and intranet. Furthermore, reports can be submitted via the Federal Office of Justice's website, and can be made in both German and English.

    The Ombudsperson is available to all whistleblowers who wish to confidentially report serious irregularities at IBB, including violations under the Whistleblower Protection Act (HinSchG). The protection and confidentiality of whistleblowers are fundamental to the handling of reports and are taken very seriously by IBB's Ombudsperson. As employers, IBB and IBB UV take all necessary measures throughout the process to protect whistleblowers from discrimination or retaliation based on the information provided. Any attempts to intimidate, threaten, or discriminate against whistleblowers in the workplace will not be tolerated.

    Contact details of the Ombudsperson

    Elke Schaefer & Dr. Kathrin J. Niewiarra
    Law firm Elke Schaefer Attorneys at Law
    Philippistr. 11
    14059 Berlin
    Phone: +49 (0) 30 / 887-1949-0
    Fax: +49 (0) 30 / 887-1949-11
    info@ra-elkeschaefer.de

    The notices can be submitted in German and English.

    In addition, notices can be submitted via the following page of the Federal Office of Justice: BfJ - Contact (bundesjustizamt.de)

    There is also a contact point for whistleblowers at the Federal Financial Supervisory Authority (BaFin) at the following Internet address: BaFin - Whistleblower Office

Complaints and feedback management in the IBB Group

Complaints and feedback management is a central element of the IBB Group's corporate strategy. It aims to promote transparency, build trust, and foster continuous improvement. To support these objectives, the Group has a comprehensive risk management system, a corporate compliance framework, and an internal audit function. The outcomes of these measures are regularly reported to the Board of Directors.

Additionally, the IBB Group—excluding the IBB Business Team—is subject to the minimum requirements for complaint management as outlined in the BaFin guidelines. All complaints are systematically documented, processed, and appropriate actions are defined. These records are retained for at least five years unless otherwise mandated by law. Special exceptions apply to the IBB Business Team.

Special attention is given to protecting and supporting employees who experience discrimination. They have access to extensive, independent, and confidential counseling services. The IBB Group's guidelines set clear objectives and define a comprehensive personal, spatial, and material scope. Prevention, counseling and the professional handling of complaints are strictly regulated. The issue of anti-discrimination is communicated internally, including through the service agreement. The contact persons of the complaints office are made visible.

In addition, the possibility of contacting the Complaints Office is mentioned in mandatory training courses for employees. The complaints procedure is designed to comply with data protection regulations, and it is clearly stated that whistleblowers may not suffer any disadvantages as a result of their report. In this way, IBB Group creates a transparent and supportive environment in which complaints are handled constructively and the rights of all parties involved are protected.

Feedback Management

Complaints and feedback from customers can be submitted directly via the Bank's website using the contact form, as well as by post, e-mail or fax. The external conciliation office of the Association of German Public Sector Banks (VÖB) is also available.

Measures to Deter Ethical Non-Compliance and Conduct Incident Investigation at IBB

At IBB, ensuring business ethics and compliance is not only but particularly a responsibility of managerial leadership, supported by robust procedures to combat and deter unethical behavior. If suspicions of criminal offenses arise - whether through internal observations or external reports – the Legal Department is promptly involved. It assesses the evidence to determine whether there are indications of a criminal offense. In cases of substantiated suspicion, criminal charges are filed.

To address crimes or fraudulent acts, the Legal Department, Internal Audit, and Corporate Compliance work closely together to ensure a thorough and coordinated response. Corporate Compliance plays a proactive role in preventing criminal acts such as fraud, embezzlement, or misappropriation. Within the internal control system, regular compliance checks and monitoring are conducted, and any indications of potential fraudulent activity - whether identified during these checks or reported through channels such as the Ombudsman—prompt immediate action.

If misconduct by non-employees is suspected, the Legal Department oversees investigations and liaises with law enforcement and judicial authorities. In cases of suspected employee misconduct, Internal Audit conducts special investigations as needed and informs the Human Resources Department if suspicions are confirmed. Human Resources then initiates further investigations and takes disciplinary measures, if necessary, ensuring close coordination with legal experts and courts.

As the third line of defense, Internal Audit also reviews, at least once every three years, the bank's preventive procedures for avoiding fraudulent acts as well as its processes for managing suspected cases. This collaborative approach ensures that incidents of unethical behavior are handled transparently and effectively, maintaining trust and accountability across the organization.

Number of the Disciplinary Actions, Contract Terminations, and Legal Proceedings within the IBB Group in 2024

In the 2024 reporting period, the IBB Group recorded no cases of corruption or bribery, no disciplinary actions against its own employees, no contract terminations with business partners due to such violations, and no involvement in public legal proceedings related to these matters.

Our Commitment to Ethical Auditing

The IBB aligns its risk management and internal controls with the requirements of MaRisk (Minimum Requirements for Risk Management) – a regulatory framework established by the German Federal Financial Supervisory Authority (BaFin) that applies to all banks in Germany.

According to MaRisk BT 2.3, the activities of Internal Audit must be based on a comprehensive audit plan that is updated annually. This plan must be risk-oriented and ensure that all key business areas are audited at least once every three years.

Topics such as business ethics, anti-corruption measures, and other aspects of the Code of Conduct - including conflict of interest prevention, integration of risk culture, and consideration of ESG criteria - are integrally included in relevant audits. For example, they are examined as part of audit activities concerning the implementation of an appropriate segregation of duties (SoD) in the procurement process, the treasury process chain, and the credit approval process. These topics are addressed according to their relevance within process audits (e.g., procurement and credit approval), as well as project and risk management audits, and are thus regularly incorporated into our audit activities.

Status: 1 Jun 2025