Liability Protection for Savings Bank Board Members: Strategies for Independent Risk Minimisation

Liability protection for the board of a savings bank requires a comprehensive strategy based on the legal foundations of section 93 of the German Stock Corporation Act (AktG, applied by analogy), the Banking Act (KWG) and the Minimum Requirements for Risk Management (MaRisk). Key pillars are a detailed risk assessment, the implementation of robust internal control systems, the legally compliant delegation of tasks and adequate D&O insurance. Independent external advice is decisive here, in order to objectively identify risk areas such as IT security and anti-money-laundering prevention and to design effective preventive measures.

A comprehensive analysis of the duties, risk areas and preventive measures for savings bank boards

Board members of savings banks are increasingly exposed to complex liability risks that go far beyond traditional banking business. A proactive and independent risk-minimisation strategy is essential to avert personal and institutional damage. This article highlights the decisive fields of action and shows how external expertise can provide lasting protection.

Key Takeaways

• The personal liability of savings bank board members is far-reaching and arises from section 93 AktG (applied by analogy), the KWG and MaRisk. Proactive engagement with these legal foundations is essential.
• IT security and anti-money-laundering prevention are central and growing risk areas. Robust internal control systems, legally compliant delegation and complete documentation are decisive for minimising liability.
• Independent, manufacturer-independent planning and consulting, as offered by PLANATEL®, is a strategic advantage. It ensures objective risk assessment, tailored solutions and compliance with regulatory requirements, providing lasting relief for boards.

The role of a savings bank board member carries considerable responsibility that extends far beyond day-to-day operations. Given a constantly changing regulatory environment and growing digital threats, the personal liability risks for board members have risen significantly. A wrong decision or the failure to take necessary organisational measures can have far-reaching financial and reputational consequences, up to and including personal recourse. It is therefore of decisive importance to develop a well-founded liability-protection strategy and to review it continuously. This requires not only a deep understanding of the legal framework, but also the ability to proactively identify potential risk areas and establish effective prevention mechanisms. Independent external expertise plays a central role here, bringing objectivity and comprehensive specialist knowledge into the process.

The legal foundations of board liability at savings banks

The liability of a savings bank's board members is primarily defined by the duty of care of a prudent and conscientious manager. Although savings banks are public-law institutions, section 93 AktG applies to the liability of their boards by analogy, even within the scope of the individual German states' savings bank laws, insofar as these contain no deviating provisions on the liability standard. This application by analogy means that board members are liable for damage caused to the institution by a breach of duty, unless they can prove that they applied the required degree of care. The burden of proof lies with the board.

In addition to the general principles of stock corporation law, specific statutory provisions such as the Banking Act (KWG) and the Minimum Requirements for Risk Management (MaRisk) issued by BaFin (Federal Financial Supervisory Authority) further specify the duties of the boards of credit institutions. MaRisk, most recently updated in May 2024 through Circular 06/2024 (BA), constitutes administrative guidance that interprets the relevant norms and is, de facto, a binding interpretation of section 25a(1) KWG. It sets out detailed requirements for business organisation and risk management, non-compliance with which can constitute a breach of duty. BaFin expects these minimum standards to be observed, as they reflect the supervisory authority's administrative practice. Compliance is reviewed as part of the annual audit and through special audits under section 44(1) KWG.

The regional savings bank laws also restrict the business activities of savings banks more strictly than the KWG and the EU-wide Capital Requirements Regulation (CRR), are considered lex specialis and take precedence. This multi-layered legal landscape requires every savings bank board to maintain comprehensive and continuously up-to-date legal knowledge.

Identifying and assessing key risk areas for savings bank boards

The liability risks for savings bank boards extend across a wide range of areas that go far beyond traditional lending business. Among the most prominent and increasingly critical risk areas are IT security and anti-money-laundering prevention. In the field of IT security, board members are legally responsible for implementing suitable technical and organisational measures to protect the institution's systems against cyberattacks and data breaches. A failure to do so can not only lead to considerable financial damage and reputational loss, but also result in the personal liability of the decision-makers. In its "Risks in Focus" reports of recent years, BaFin has repeatedly highlighted cyber incidents with serious impact as a top risk.

Another critical area is anti-money-laundering prevention. With the new anti-money-laundering regulation and the AMLA regime, whose implementation is expected by July 2027, the focus is increasingly shifting to the personal responsibility of top management. Inadequate prevention can not only lead to heavy fines and criminal consequences, but also endanger the integrity and stability of the entire financial centre. Boards must ensure that the statutory requirements of the Anti-Money Laundering Act (GWG) and the KWG are fully implemented in the savings bank's practice.

Further risks exist in lending business, in particular regarding loans to companies undergoing restructuring or non-compliance with internal authority rules and limits. Compliance with organisational duties under section 25a KWG and MaRisk, which prescribe proper business organisation and effective risk management, is also a constant test. A comprehensive risk assessment must systematically capture and evaluate all of these areas, in order to create a solid basis for preventive measures.

Preventive measures to minimise liability: internal control systems and delegation

To minimise personal liability, savings bank boards must proactively and systematically implement preventive measures. A central building block is the establishment and continuous maintenance of a robust internal control system (ICS). This ICS must cover all essential business processes and risk areas, from lending to IT security to anti-money-laundering prevention. MaRisk explicitly requires a monitoring system that enables developments threatening the institution's continued existence to be recognised early. This includes clear policies, process descriptions, segregation of duties and regular controls. The effectiveness of the ICS must be reviewed regularly and adjusted as needed.

The legally compliant delegation of tasks is another decisive strategy. Boards can and must delegate tasks, particularly in complex areas such as IT security. However, the utmost care is required here: responsibility for IT security remains, in principle, with the organisation's leadership. Delegation does not relieve the board of its duty to supervise and select. It must be ensured that the delegated persons have the necessary expertise and resources and properly fulfil their tasks. Inadequate selection or supervision can lead to the board's liability in the event of damage.

Key elements of successful delegation include:

• Clear description of tasks: Precise definition of responsibilities and competencies.
• Qualification of staff: Ensuring that the persons entrusted with the tasks are professionally suited.
• Regular reporting: Establishing reporting channels that enable effective supervision.
• Documentation: Complete records of all delegation decisions, instructions and control results, so that compliance with the duty of care can be demonstrated in the event of a claim.

These measures create a framework that enables the board to fulfil its duties while managing the complexity of day-to-day business.

The importance of a comprehensive, independent risk assessment

Well-founded liability protection begins with a comprehensive risk assessment. This must go beyond a mere stocktaking exercise and include an in-depth analysis of all potential dangers to the savings bank and its governing bodies. In its "Risks in Focus" reports, BaFin emphasises the need to precisely identify and assess risks such as cyber incidents, inadequate anti-money-laundering prevention and concentrations arising from the outsourcing of IT services. Effective risk management, as also described in ISO 31000, obliges company management to identify, analyse and assess risks in order to establish a risk-management culture.

The decisive factor for the quality of such an assessment is its independence. Internal assessments can, even unconsciously, be influenced by organisational blind spots or conflicts of interest. An external, manufacturer-independent perspective ensures an objective and unbiased assessment of the actual risk situation. Independent consultants such as PLANATEL® bring over 34 years of experience in analysing complex infrastructures and processes. They are not bound to selling particular products or solutions and can therefore give recommendations that serve exclusively the interests of the savings bank.

This independent risk assessment typically includes:

• As-is analysis: Detailed recording of the existing IT, telecommunications and security systems as well as the associated processes.
• Needs analysis: Determination of the actual protection requirement, taking into account regulatory requirements (e.g. MaRisk, KWG) and specific business risks.
• Vulnerability analysis: Identification of gaps in the organisation, systems and processes that could carry liability risks.
• Risk assessment: Quantification and qualification of the identified risks in terms of their probability of occurrence and potential impact.

Only on the basis of such an objective assessment can targeted and effective measures for minimising liability be developed.

The role of D&O insurance in liability protection

Directors-and-officers insurance (D&O insurance) is an essential component of liability protection for savings bank boards. It is a financial loss liability insurance taken out by the company for its governing bodies and senior executives. Its purpose is to protect board members from financial risks arising from wrong decisions or breaches of duty in their professional activity, both towards the company itself (internal liability) and towards third parties (external liability).

It is crucial to understand, however, that D&O insurance is not a cure-all and has certain limits. It generally does not apply in cases of intentional breach of duty or knowing misconduct. In addition, insurance cover is tied to the demonstrability of culpable, wrongful conduct that has led to a financial loss. In the event of a claim, the D&O insurer first examines the liability claims and rejects unjustified demands, while covering legitimate claims within the insured scope.

Structuring the D&O contract requires careful review and individual adjustment to the specific risk profiles of the savings bank and its board. Factors such as the level of the sum insured, the scope of cover and the exclusions must be negotiated precisely. Independent advice can help identify the optimal cover and ensure that the contract has no unexpected gaps. D&O insurance is thus an important addition to comprehensive risk management, but in no way replaces it. It provides financial protection, but the primary responsibility for avoiding damage and complying with the duty of care always remains with the board.

Independent planning and consulting as a strategic advantage for savings banks

In the complex landscape of board liability and risk management, independent planning and consulting represents a decisive strategic advantage for savings banks. PLANATEL® has operated since 1992 as a 100% independent and financially neutral consulting company. This independence is of the utmost importance, as it ensures that all recommendations and concepts serve exclusively the interests of the savings bank and are not influenced by manufacturer preferences or commission models. With over 34 years of experience in planning and optimising complex infrastructures in IT, telecommunications and security systems, PLANATEL® offers expertise that is of inestimable value to savings bank boards.

Our services include the detailed as-is survey, needs analysis and target concept for critical infrastructure. This is particularly relevant for liability protection in the context of IT security and fulfilling MaRisk requirements. Through manufacturer-independent detailed planning and support during tender and award processes, we ensure that the implemented solutions are not only technically optimal, but also legally compliant and economical. We help savings banks fulfil their organisational duties, for example by developing concepts for fire alarm systems in accordance with DIN 14675 or intrusion detection systems that comply with VdS guidelines. Such systems are an integral part of a comprehensive security concept and contribute directly to minimising operational risks, which in turn reduce liability risks for the board.

Working with an independent consultant enables savings banks to objectively identify weaknesses, precisely assess risks and implement tailored solutions that meet the institution's specific requirements. This not only strengthens the savings bank's resilience, but also gives the board the assurance that all reasonable measures for minimising liability have been taken.

Practical implementation: case examples and PLANATEL®'s contribution

The theory of liability protection becomes tangible in practice through concrete projects and decisions. Consider a scenario: a savings bank is planning to introduce a new, complex IT infrastructure to digitalise its customer services. Without careful planning and risk assessment, this could create significant liability risks for the board, particularly with regard to data protection (GDPR), IT security (IT Security Act, MaRisk) and compliance with organisational duties. In such a case, PLANATEL® would first carry out a comprehensive as-is and needs analysis to identify the specific requirements and potential risks of the new infrastructure. This includes assessing cyber resilience, analysing interfaces with existing systems and ensuring legally compliant data processing.

We then develop a manufacturer-independent target concept and detailed plan that takes into account not only the technical specifications, but also organisational measures (e.g. authorisation concepts, contingency plans). During the tender and award process, we select certified installers and accompany the entire implementation process, to ensure that the planned measures are correctly carried out. Through the final acceptance and invoice review, we ensure that the contractually agreed services have been delivered and that the systems meet the highest standards. This not only minimises technical and operational risks, but also provides the board with the documentation necessary to demonstrate compliance with its duty of care in the event of a claim.

A further example is the optimisation of existing telecommunications systems. Outdated systems can have security gaps and impair communication in an emergency. PLANATEL® analyses the existing telecommunications infrastructure, identifies weaknesses and plans migration to modern, secure unified communication solutions. This not only reduces operating costs, but also increases resilience and protects against communication failures that could have significant liability consequences in a real emergency. Through our expertise in planning security management systems and building management technology, we also help ensure the physical security of the savings bank's infrastructure, which is likewise a relevant aspect of board liability.

Continuous monitoring and adjustment of the risk strategy

Liability protection for a savings bank's board is not a one-off project, but a continuous process that requires constant monitoring and adjustment of the risk strategy. The regulatory environment, technological developments and the threat landscape change dynamically. What is considered legally compliant and secure today may already be outdated tomorrow. MaRisk itself is regularly updated, as shown by BaFin's recent consultations on the WpI-MaRisk, which, although intended for investment firms, underline the general trend towards more precise and proportionate requirements in risk management.

Boards are therefore obliged to regularly evaluate the effectiveness of their risk management systems and internal controls and adjust them as needed. This includes reviewing the adequacy of IT security measures, updating anti-money-laundering prevention concepts and adjusting organisational guidelines. Such continuous monitoring requires not only internal resources, but also benefits considerably from external expertise. PLANATEL® supports savings banks through regular audits, optimisation consulting and support in implementing new regulatory requirements. We help keep the risk inventory current and ensure that the savings bank always meets the latest standards and best practices.

The benefits of such ongoing support are manifold: it not only ensures lasting legal compliance and minimises liability risks for the board, but also optimises the efficiency of processes and systems. Through proactive action, savings banks can not only avoid potential damage, but also strengthen their competitiveness and reinforce the trust of their customers and supervisory authorities. A future-proof savings bank is characterised by an agile and adaptable risk strategy, continuously supported by independent expert advice.

Next step

Contact us for a non-binding initial consultation.

PLANATEL®: Independent planning and consulting since 1992
Tel: 040 / 23 73 02-30
Email: info@planatel.de

Frequently asked questions

What role does MaRisk play in liability protection for savings bank boards?

BaFin's Minimum Requirements for Risk Management (MaRisk) specify the organisational duties of credit institutions under section 25a KWG and are de facto binding. They set out detailed standards for risk management, internal control systems and business organisation. For savings bank boards, this means that non-compliance with MaRisk can be assessed as a breach of duty, giving rise to personal liability. MaRisk is regularly updated, most recently in May 2024, and compliance is monitored by BaFin and external auditors. Proactive implementation and continuous adaptation to MaRisk is therefore a central component of liability protection.

How can savings bank boards fulfil their duty of care in anti-money-laundering prevention?

To fulfil their duty of care in anti-money-laundering prevention, savings bank boards must ensure that the requirements of the Anti-Money Laundering Act (GWG) and the KWG are fully implemented. This includes establishing effective risk management to identify and assess money-laundering risks, implementing suitable internal safeguards, appointing a money-laundering officer, and regularly training staff. Given the growing personal responsibility of top management, particularly with a view to the EU anti-money-laundering regime by July 2027, continuous review and adjustment of prevention measures is essential.

How important is documenting decisions for liability protection?

Complete documentation of decisions and their underlying basis is of the utmost importance for the liability protection of savings bank boards. In the event of a claim, boards must be able to demonstrate that they fulfilled their duty of care and made decisions on a well-founded basis. This includes documenting risk assessments, weighing alternatives, obtaining expert opinions, delegating tasks and monitoring processes. Transparent and traceable documentation is decisive for being able to rely on the business judgement rule and to meet the reversal of the burden of proof in a liability case.

How does PLANATEL® support savings banks in reducing liability risks in IT and telecommunications?

PLANATEL® supports savings banks through independent planning and consulting in IT and telecommunications, to reduce liability risks. This begins with a detailed analysis of the existing infrastructure and processes, to identify weaknesses and risks. We then develop manufacturer-independent concepts for secure IT architectures, resilient telecommunications systems and legally compliant data processing. Through support during tenders, the selection of certified installers and the monitoring of implementation, we ensure that the solutions meet the highest security standards and regulatory requirements (e.g. MaRisk). This relieves the board by ensuring compliance with its organisational and supervisory duties and creates the basis for effective liability protection.

What role does the choice of service providers and partners play in liability protection?

The choice of service providers and partners plays a decisive role in the liability protection of savings bank boards, particularly when outsourcing IT services or commissioning installers for security systems. The board remains responsible for the proper performance of tasks even when delegating or outsourcing them. It must be ensured that the chosen partners have the necessary expertise, certifications and reliability. Careful due diligence, clear contractual arrangements and continuous monitoring of service delivery are essential. Independent consultants such as PLANATEL® support savings banks in the objective selection of qualified partners, to minimise the risks arising from working with third parties.

Which laws govern the liability of savings bank boards in Germany?

The liability of savings bank boards is primarily governed by the application by analogy of section 93 of the Stock Corporation Act (AktG), which sets out the duty of care of a prudent and conscientious manager. In addition, the Banking Act (KWG) and BaFin's Minimum Requirements for Risk Management (MaRisk) specify the particular duties for credit institutions. The respective state-specific savings bank laws are also relevant, and are considered lex specialis.

What are the biggest liability risks for savings bank boards in the field of IT?

In the field of IT, the biggest liability risks for savings bank boards are cyberattacks, data breaches and inadequate IT security measures. Boards are legally responsible for implementing suitable technical and organisational protective measures. A failure to do so can lead to considerable financial damage, reputational loss and personal liability, particularly as BaFin classifies IT risks as critical.

How can D&O insurance contribute to liability protection?

D&O insurance (directors-and-officers insurance) protects board members from financial risks arising from wrong decisions or breaches of duty in their professional activity. It covers financial losses incurred by the company or third parties. It is important to note, however, that it generally does not apply in cases of intentional breach of duty, and does not replace careful contract drafting or comprehensive risk management.

Why is independent advice important for savings bank boards?

Independent advice is essential for savings bank boards, as it enables an objective and unbiased assessment of the risk situation. External consultants are not bound to selling specific products and can recommend tailored, manufacturer-independent solutions that serve exclusively the interests of the savings bank. This helps avoid organisational blind spots, precisely identify weaknesses, and develop legally compliant and economically optimal strategies for minimising liability.

Sources and further information

• Haftung von Sparkassenvorständen : FHRW – Rechtsanwälte in Mühlhausen
• Haftung eines Sparkassenvorstands – Wirtschaft.Recht.Aktuell
• D & O Versicherung: Managerhaftpflicht | Sparkasse.de
• Vorstände einer Sparkasse haften analog § 93 AktG – Dr Stefan Steinkühler
• D&O Versicherung – SV SparkassenVersicherung