Investment Management Client Alert August 2026

Law Implementing the EU AI Regulation Takes Effect

On 29 July 2026, the Law Implementing the European Union (EU) Artificial Intelligence (AI) Regulation (Regulation (EU) 2024/1689) came into force. It has generally been directly applicable since 2 August 2026 and has established a uniform legal framework for the development, placing on the market, putting into service, and use of artificial intelligence systems (AI systems) in the EU. A key component of this act is the Act on Market Surveillance and the Promotion of Innovation in Artificial Intelligence (AI-MIG).

Section 2(3) of the AI-MIG assigns the Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, BaFin) the role of competent market surveillance authority for AI systems directly related to a regulated financial activity that are placed on the market, put into operation, or used by certain companies supervised by BaFin. This applies in particular to credit institutions, financial services institutions, securities firms, payment institutions, and asset management companies. BaFin’s market surveillance focuses in particular on ensuring compliance with transparency requirements for AI systems that interact directly with people (such as chatbots used in customer communications) and on ensuring compliance with the provisions of the EU AI Regulation regarding prohibited AI practices. BaFin’s market supervision also covers so-called high-risk AI systems, which include, for example, systems used by credit institutions as part of creditworthiness assessments. AI systems that are not directly related to a regulated financial activity (such as AI applications used in human resources management) fall under the jurisdiction of the Federal Network Agency.

BaFin Circular 08/2026 (WA)—Investment Products are Generally Not Packaged Investment Products Under the PRIIPs Regulation

In Circular 08/2026 (WA) dated 27 July 2026, BaFin clarifies that investment products are generally not classified as packaged investment products (PRIIPs) under the PRIIPs Regulation (Regulation (EU) No. 1286/2014). Providers who publicly offer investment products in Germany must therefore continue to regularly prepare an Investment Product Information Sheet (VIB)—which must be approved and filed with BaFin—instead of a Key Information Document under the PRIIPs Regulation.

Background: A PRIP exists when the redemption amount depends on external benchmarks or assets not directly acquired. Corporate equity interests such as stocks are exempt from this, as their value is determined by the company’s performance. BaFin applies this logic to investment products: since they are typically part of the issuer’s equity or have an equity-like character, investment products under Section 1(2) nos. 1-6 of the German Investment Products Act (Gesetz über Vermögensanlagen, VermAnlG) are generally not considered PRIPs. Investment products under Section 1(2) nos. 7 and 8 of the VermAnlG are also generally not subject to the PRIIPs Regulation; however, given the wide range of possible structures under the catch-all provision of No. 7, individual cases are conceivable in which a PRIP classification may still apply.

The final classification always depends on a case-by-case assessment based on the economic characteristics and terms and conditions, which must initially be carried out by the manufacturers and distributors of the products. In practice, however, the circular provides greater legal certainty: providers can generally remain under the VIB regime.

ESMA Clarifies Transitional Rules for ESG Ratings

On 1 July 2026, the European Securities and Markets Authority (ESMA) issued a public statement clarifying whether third parties that publish or disseminate environmental, social, and governance (ESG) ratings from existing but not yet authorized ESG rating providers may continue to do so as of 2 July 2026.

The ESG Rating Regulation (Regulation (EU) 2024/3005), which takes effect on 2 July 2026, requires ESG rating providers that prepare, publish, or disseminate ESG ratings in the EU to apply for authorization from ESMA.

Existing medium-sized and large ESG rating providers that wish to continue operating in the EU must have notified ESMA of their intention to apply for authorization by 2 August 2026 and must submit their application for authorization no later than 2 November 2026. Small ESG rating providers wishing to benefit from the transitional arrangement must notify ESMA of this by 2 November 2026, at the latest. On its website, ESMA urges all companies to submit their applications between 2 September and 2 November 2026.

At the same time, third parties, such as asset managers, may continue to publish or disseminate the ESG ratings of these ESG rating providers until ESMA has made a decision on whether to grant or reject the application for authorization or recognition, or on the registration of the notifying party as a small ESG rating provider. To this end, ESMA will periodically publish and update a list of companies that have notified ESMA of their intention to continue operating in the EU.

After 2 November 2026, third parties are prohibited from publishing or disseminating the ESG ratings of an ESG rating provider, unless that provider (i) has submitted an application for authorization or recognition or a notification of registration under the transitional arrangement for small ESG rating providers, and (ii) is listed in the register on the ESMA website.

BaFin Supervisory Notice on the PFOF Ban

On 22 July 2026, BaFin published its Supervisory Notice (05/2026 (WA)) regarding the full entry into force of the ban on accepting payments from third parties for the routing of client orders to trading venues (the so-called Payment for Order Flow (PFOF) ban). The ban was introduced by the revision of the EU Regulation on Markets in Financial Instruments (MiFIR) and takes effect on 1 July 2026. It applies to investment firms and affects, among others, so-called neo-banks.

The purpose of the ban is to improve the execution quality of retail orders, as third-party payments for order routing create irreconcilable conflicts of interest in the selection of trading venues.

It is prohibited to pay the PFOF on behalf of the client, whereby market makers funnel PFOF back to the investment firm via the client’s account (including through an intermediary broker), which then discounts its order fee accordingly.

In its supervisory notice, BaFin also outlines what it considers to be compliant business practices.

Among other things, the execution of client orders on a proprietary basis (e.g., as a systematic internalizer or market maker) is considered compliant, provided that the best execution obligations under Article 27(1) of the EU Directive on Markets in Financial Instruments (MiFID II) are met.