flatexDEGIRO’s later €1m fine was about disclosure, not the original control failure

BaFin’s €1 million fine against flatexDEGIRO SE in April 2026 did not punish the listed company for newly discovered control failures. It concerned the timing and form of disclosure of information arising from a 2022 special audit at flatexDEGIRO Bank AG. The regulator said the issuer failed to publish inside information without delay through an ad hoc announcement, as required by Article 17 of the Market Abuse Regulation.[1][4]

That sanction is legally distinct from the supervisory measures disclosed in 2023. BaFin had ordered the bank to remedy serious shortcomings in internal controls, supervisory reporting, risk management and money-laundering prevention; appointed a special commissioner; imposed additional own-funds requirements; and issued a separate €1.05 million fine against flatexDEGIRO Bank AG. The earlier matter addressed the bank’s organisation. The later matter addressed the listed issuer’s market disclosure.[1][2]

Collapsing the two into a single €2.05 million punishment for one breach would misstate the entity, law and conduct. The €1.05 million order was against the bank under banking-supervision and administrative-offence provisions. The €1 million order was against flatexDEGIRO SE under the Market Abuse Regulation. The same special-audit facts linked the cases, but the legal duties operated at different layers of the group.[1][2]

The later offence was about the information clock

Ad hoc disclosure rules ask when a reasonable investor should have received price-sensitive information, not only whether the underlying operational problem was eventually corrected. BaFin’s notice says the company did not disclose the inside information. Secondary regulatory records reproducing the notice identify that information as the findings of the 2022 special audit, which were later communicated through an ordinary press release rather than promptly through an ad hoc announcement.[1][4]

An ordinary press release and an Article 17 announcement are not interchangeable. The ad hoc regime is designed to distribute inside information promptly and simultaneously through recognised channels, creating a timestamped market record. A corporate-news release can be widely read but may arrive later, use a different distribution network or fail to signal that the information has been assessed as inside information.[1][4]

The market-abuse duty can apply even when the issuer disputes how investors will react. Price sensitivity is assessed ex ante from the nature and likely significance of the information, not solely from the share-price movement after publication. The 2026 fine therefore should not be described as proof that management concealed the audit findings for a fraudulent purpose; the final notice establishes a disclosure breach, not intentional deception or concealment.[1][4]

The original supervisory record was broader

BaFin’s March 2023 publication said the bank had serious shortcomings in internal controls, supervisory reporting and money-laundering prevention. It ordered the institution to establish a proper business organisation, appointed a special commissioner to monitor implementation, and referred to an additional own-funds requirement imposed on the bank and financial holding group in September 2022.[2]

The €1.05 million fine became final on 7 February 2023, while the supervisory measures were final from 21 February. The regulator linked the fine to a breach of supervisory duties under the German Banking Act and Capital Requirements Regulation through the administrative-offence framework. Those dates and provisions matter because they show that the bank-control case had its own completed enforcement path years before the issuer-disclosure fine.[2]

The special commissioner was not a permanent management replacement. The role was to monitor remediation. flatexDEGIRO announced in October 2024 that BaFin had terminated the mandate with effect from 30 September after the company eliminated the serious deficiencies identified in the 2022 audit and received a positive review from the commissioner. Its annual report repeated that chronology.[3]

Remediation did not erase the earlier disclosure duty

The end of the special commissioner’s mandate is evidence that the serious deficiencies were remediated to the supervisor’s satisfaction. It does not retrospectively answer whether the issuer disclosed the findings at the legally required moment in 2022. Operational remediation and market transparency run on separate clocks: one asks whether controls were fixed; the other asks whether investors received inside information promptly.[1][2][3]

This separation explains why a final fine could arrive after the underlying control programme had closed. Enforcement investigations, legal review and the opportunity to object can take years. The 2026 notice says the decision was imposed on 20 April and became legally binding on 7 May. The lag does not mean the disclosure failure continued until 2026.[1]

It also prevents a second overstatement: the 2026 decision should not be presented as BaFin reopening the 2022 special audit or finding that the remediation failed. The reviewed notice addresses Article 17 disclosure. The company’s 2024 announcement and annual report state that the commissioner’s mandate ended following successful elimination of the serious deficiencies and a positive review.[1][3]

The corporate-entity change requires care

The earlier sources use flatexDEGIRO AG and flatexDEGIRO Bank AG; the later fine names flatexDEGIRO SE. Corporate-form changes and group naming can cause apparent inconsistencies in a timeline. The bank remains a separate regulated entity from the listed parent or issuer. A report should identify the exact legal person in each action rather than shortening every reference to ‘DEGIRO’ or ‘flatex’.[1][2][3]

That discipline matters to customers. A bank-supervision order can bear directly on controls around the regulated institution holding cash, granting margin or processing transactions. An issuer-disclosure fine protects capital-market investors in the listed company. Both can affect confidence, but they do not confer the same customer remedy or establish the same operational risk.[1][2][4]

What remains unresolved in the public notice

The reproduced 2026 notice is concise. It does not publish the complete administrative decision, the precise date on which BaFin concluded the information became inside information, the company’s internal escalation record, or the reasoning used to assess price sensitivity. Those details would be needed to reconstruct the exact delay and governance failure.[1]

The conclusion would change if a full decision showed that the fine related to different information, a different entity or a continuing control deficiency. The reviewed notice and linked regulatory summaries consistently identify the Article 17 failure and the 2022 special-audit findings. The 2023 BaFin publication separately identifies the organisational case, which supports rather than contradicts the two-track reconstruction.[1][2]

The published notices do not identify the complete internal disclosure timeline, the officers or committee responsible for the inside-information assessment, or the company’s contemporaneous legal reasoning. Those missing facts limit any inference about intent or duration. They do not alter the documented final status of the €1 million disclosure fine or merge it with the separate supervisory case.[1][2]

The defensible finding is therefore precise. The group’s regulatory history contains an operational-control case and a later market-disclosure case. The special commissioner’s successful exit closed a major remediation chapter; it did not cancel the duty to have told investors promptly when the chapter began. Keeping those tracks separate produces a more serious account than adding two fines and calling them one event.[1][2][3]

Report an error or submit an update