What this guide covers
This guide provides a practical walkthrough of complaint handling requirements for financial services firms operating in Germany under BaFin supervision. It is written for complaint operations teams, compliance officers, and quality assurance staff at payment institutions, e-money issuers, and fintech firms licensed or passporting into the German market.
Germany's complaint handling framework sits at the intersection of European directives (PSD2, the ADR Directive) and national legislation (the Zahlungsdiensteaufsichtsgesetz, or ZAG, for payment services, and the broader supervisory laws for banking and investment). BaFin does not prescribe a single complaint-handling rulebook equivalent to the UK's DISP sourcebook, but it enforces complaint management expectations through circulars, supervisory guidance, and the general organisational requirements imposed on regulated firms.
For firms entering the German market or managing cross-border complaint flows from a UK or EEA hub, the operational challenge is clear: you must meet BaFin's supervisory expectations, comply with PSD2 payment complaint deadlines transposed into ZAG, and ensure consumers can access the Schlichtungsstelle der Deutschen Bundesbank as the designated ADR body for payment disputes.
BaFin complaint management framework
BaFin's approach to complaint handling is built on the principle that effective complaint management is an integral part of a firm's organisational requirements. The legal basis varies by sector. Payment institutions and e-money firms fall under ZAG. Banks fall under the Kreditwesengesetz (KWG). Insurance firms fall under the Versicherungsaufsichtsgesetz (VAG). Investment firms fall under the Wertpapierhandelsgesetz (WpHG). Across all sectors, BaFin expects firms to have written complaint management policies, a designated complaints function, and internal reporting that allows senior management to identify systemic issues.
BaFin's supervisory circulars set out expectations for complaint handling that align with the Joint Committee of the European Supervisory Authorities Guidelines on Complaints Handling (JC 2018 35). These guidelines require firms to have a complaint management policy approved by the management body, to record and track all complaints, and to resolve them within a reasonable timeframe. For general complaints outside the scope of specific PSD2 deadlines, the Joint Committee guidelines establish a benchmark of 56 calendar days.
Unlike the UK's FCA, BaFin does not publish a single complaints sourcebook with step-by-step rules. Instead, the expectations are distributed across circulars, minimum requirements for risk management (MaRisk), and the general duty to operate in an orderly manner under the applicable supervisory law. This means compliance teams need to construct their complaint handling process from multiple regulatory sources rather than following a single linear rulebook.
- Maintain a written complaint management policy approved by the management board (Geschaeftsleitung).
- Appoint a complaints management function that is independent from the business units generating complaints.
- Ensure complaints received through any channel (letter, email, phone, online form, social media) are captured and tracked centrally.
- Report complaint volumes, themes, and outcomes to the management board at a regular cadence, at least quarterly.
- Align internal policies with the Joint Committee Guidelines on Complaints Handling and any BaFin-specific circulars applicable to your licence type.
ZAG requirements for payment institutions
The Zahlungsdiensteaufsichtsgesetz (ZAG) is Germany's national transposition of PSD2 and the E-Money Directive. It applies to all payment institutions (Zahlungsinstitute), e-money institutions (E-Geld-Institute), and account information or payment initiation service providers registered or licensed by BaFin.
Section 60 ZAG requires payment service providers to establish appropriate and effective complaint procedures. These procedures must be documented in writing, made available to customers, and ensure that complaints are handled fairly and promptly. The ZAG complaint provisions work alongside the broader BaFin supervisory expectations and create specific obligations that go beyond the general 56 calendar day guideline.
For payment-related complaints specifically, ZAG transposes Article 101 of PSD2, which requires payment service providers to respond to payment complaints within 15 business days of receipt. In exceptional circumstances where the provider cannot respond within 15 business days for reasons beyond its control, it must send a holding response explaining the delay and specifying a final deadline that must not exceed 35 business days from the date of receipt.
The 15 business day deadline applies to complaints about the execution of payment transactions, unauthorised transactions, transaction fees, exchange rates, and the provision of payment services generally. Complaints about non-payment matters (such as general account administration or marketing communications) fall under the general 56 calendar day expectation rather than the shorter PSD2 timeline.
- Apply the 15 business day deadline to all complaints that relate to the provision of payment services or the execution of payment transactions.
- If the 15 business day deadline cannot be met, send a holding response before day 15 explaining the reason for the delay and specifying a final response date no later than 35 business days from receipt.
- For complaints that do not relate to payment services, apply the general 56 calendar day resolution expectation from the Joint Committee Guidelines.
- Document the classification of each complaint (payment vs non-payment) at intake, as this determines which deadline applies.
- Ensure the complaint management system can track and alert on both the 15 business day and 56 calendar day deadlines separately.
Schlichtungsstelle ombudsman referral process
Germany's ADR infrastructure for payment complaints is centred on the Schlichtungsstelle der Deutschen Bundesbank. This is the dispute resolution body established under the Verbraucherstreitbeilegungsgesetz (VSBG, the Consumer Dispute Resolution Act) and designated by the Bundesbank to handle complaints against payment service providers.
The Schlichtungsstelle accepts complaints from consumers who have been unable to resolve a dispute directly with their payment service provider. The process is free for consumers. Firms are required to participate in the Schlichtungsstelle process under ZAG, and a refusal to participate can attract supervisory attention from BaFin.
The referral process works as follows. The consumer submits a complaint to the Schlichtungsstelle, typically via an online form or in writing. The Schlichtungsstelle reviews the complaint for admissibility, contacts the firm for its position, and issues a recommendation. The recommendation is not legally binding on either party, but firms that consistently refuse to follow Schlichtungsstelle recommendations may face reputational consequences and increased BaFin scrutiny.
Firms must inform customers about the Schlichtungsstelle at two points: first, on their website and in their general terms and conditions; second, in response to any complaint that the firm cannot resolve to the customer's satisfaction. The notification must include the name and contact details of the Schlichtungsstelle, the website address, and a statement that the customer is entitled to refer the matter.
For non-payment financial services (banking, insurance, investment), different ombudsman schemes apply. The Ombudsmann der privaten Banken (private banks ombudsman) handles complaints against member banks. Insurance complaints go to the Versicherungsombudsmann. Firms that hold multiple licences need to direct complainants to the correct ADR body based on the subject matter of the complaint.
- Include Schlichtungsstelle contact details on your website and in your general terms and conditions.
- In every final complaint response where the customer is not satisfied, include clear information about the right to refer to the Schlichtungsstelle.
- Designate an internal point of contact who handles all Schlichtungsstelle correspondence and case file preparation.
- Respond to Schlichtungsstelle enquiries within the deadline specified in their request, typically 4 to 6 weeks.
- Track Schlichtungsstelle referrals as a key complaint metric, as a rising referral rate signals that internal complaint resolution is failing.
Record-keeping requirements
BaFin's record-keeping expectations for complaints are more prescriptive than many firms initially assume. The general duty to maintain orderly business organisation under the applicable supervisory law (KWG, ZAG, VAG, WpHG) extends to complaint records. BaFin expects firms to maintain a centralised complaint register that captures enough detail to reconstruct the complaint handling process for each case.
The complaint register should include, at a minimum, the date of receipt, the identity of the complainant, the subject matter and product involved, the complaint category, all communications with the complainant, internal investigation notes, the outcome, the date of resolution, and any redress or remediation provided. For payment complaints subject to ZAG, the register must also record whether the 15 business day deadline was met and, if a holding response was sent, the reason for the extension and the final response date.
Records must be retained for a minimum of five years from the date of complaint closure, in line with general German commercial record-keeping requirements under the Handelsgesetzbuch (HGB). Some supervisory laws may impose longer retention periods for specific categories of records. Firms should apply the longest applicable retention period rather than the shortest.
BaFin may request complaint records during routine supervisory examinations or in response to a specific concern. The records must be in a format that allows BaFin examiners to review individual cases and to identify patterns across the complaint population. A complaint register that contains only summary data (dates and outcomes without supporting detail) is insufficient.
- Maintain a centralised complaint register that captures all required data fields for each complaint.
- Retain complaint records for a minimum of five years from the date of closure.
- Ensure records include full communication histories, investigation notes, and evidence, not just summary outcomes.
- Store records in a format that allows both individual case review and aggregate analysis.
- Implement access controls so that complaint records are protected but available for regulatory examination.
Common operational pitfalls
Firms operating in the German market, particularly those passporting from the UK or another EEA jurisdiction, encounter a predictable set of operational failures when setting up their complaint handling processes. These failures are avoidable with proper process design, but they recur because firms underestimate the differences between the German framework and the regulatory environments they are more familiar with.
The most common pitfall is applying a single deadline to all complaints. Firms that set up their complaint management system with one deadline, whether it is the UK's eight weeks, the general 56 calendar days, or some other internal target, will breach the ZAG 15 business day requirement for payment complaints. The system must distinguish between payment and non-payment complaints at intake and apply the correct deadline to each.
A second common failure is incomplete ADR disclosure. German law requires firms to inform consumers about the relevant Schlichtungsstelle on their website, in their terms and conditions, and in complaint responses. Firms that provide this information only in their terms and conditions, or only on a page buried deep in their website, are not meeting the disclosure requirement. The information must be prominent and accessible.
A third pitfall is the assumption that BaFin complaint supervision is less intensive than the FCA's. While BaFin does not require firms to submit regular complaint data returns in the same way the FCA does under DISP 1.10, BaFin can and does request complaint data during supervisory examinations. Firms that treat complaint record-keeping as optional because they do not face a regular reporting obligation are likely to fail when an examination occurs.
Firms that use Germany as a passporting hub to serve other EEA markets must also manage the language dimension. Complaints from German consumers should be handled in German, and the Schlichtungsstelle process is conducted in German. Firms that operate from a centralised English-language complaint team may need to invest in German-language complaint handling capability or outsource to a local partner.
Finally, firms often fail to track Schlichtungsstelle referrals and outcomes as a management information metric. A rising rate of ombudsman referrals is a leading indicator of complaint handling failure, and firms that do not track this data cannot identify and address the underlying problems.
- Configure the complaint management system to apply the correct deadline based on complaint category: 15 business days for payment complaints, 56 calendar days for general complaints.
- Publish Schlichtungsstelle information prominently on the firm's website, not only in the terms and conditions.
- Include ADR referral information in every complaint response where the customer is not fully satisfied.
- Maintain complaint records to a standard that will survive a BaFin supervisory examination, even in the absence of regular reporting obligations.
- Invest in German-language complaint handling capability if serving German consumers.
- Track Schlichtungsstelle referral rates and outcomes as a key management information metric.
Management information and root-cause analysis
BaFin's supervisory framework expects firms to use complaint data as a source of management information. MaRisk (Mindestanforderungen an das Risikomanagement, the minimum requirements for risk management) requires firms to have processes for identifying, measuring, and managing operational risk, and complaint trends are a key input to that process. Firms that resolve individual complaints without investigating patterns are meeting the minimum standard but not the supervisory expectation.
The management board (Geschaeftsleitung) should receive regular reporting on complaint volumes, categories, resolution times, Schlichtungsstelle referrals, and systemic themes. This reporting should go beyond raw numbers and include analysis of root causes, trend identification, and recommendations for remediation. BaFin has indicated that it expects boards to discuss complaint data and to take action when patterns indicate systemic problems with products, processes, or customer communication.
Root-cause analysis should distinguish between individual complaints where the firm made an error in a specific case and systemic complaints where a product design, process weakness, or communication failure is generating a pattern of dissatisfaction. Systemic complaints require a different response: rather than resolving each case individually, the firm should address the underlying cause and consider whether proactive customer contact or remediation is appropriate.
For firms operating across multiple EEA markets from a German hub, complaint management information should be analysed both in aggregate and by market. Complaint patterns may vary significantly between markets due to differences in customer expectations, regulatory environment, and product usage. Market-level analysis can reveal issues that are invisible in aggregate data and help the firm tailor its approach to each jurisdiction.
The complaint management function should have a direct reporting line into the firm's governance structure. If complaints are buried in a customer service department without visibility at board level, the firm is not meeting BaFin's governance expectations. The complaints function should present findings to the board at least quarterly, with more frequent reporting if complaint volumes are high or trends are deteriorating.
- Provide the management board with complaint MI at least quarterly, including volumes, themes, deadline adherence, and ADR referrals.
- Conduct root-cause analysis that distinguishes between individual errors and systemic patterns.
- Analyse complaint data by market when operating across multiple EEA jurisdictions.
- Ensure the complaint function has a direct reporting line to a governance body with authority to approve remediation actions.
- Track whether remediation actions reduce complaint volumes in subsequent reporting periods.
- Document complaint MI reporting and board responses for BaFin supervisory examination.
Checklist: German complaint handling at a glance
Use this table as a quick reference for the core steps, the applicable rule or guideline, and the key requirement at each stage of complaint handling under BaFin supervision.