If you have similar challenges and questions, please contact our specialists.

Those operating in the financial sector are bound by various laws along with requirements for internal audit arising from those laws. In addition, the Auditors Activities Act governs the provision of internal audit service, defining who is allowed to be engaged in the professional activities of an internal auditor.
An internal audit is obligatory for a large share of companies in the financial sector. Data on internal auditor must be submitted to the Financial Inspectorate already upon applying for an operating licence. Internal procedure rules must also describe how internal audits are organized and their function in the enterprise.
The following companies in the financial sector are subject to the internal audit obligation:
- credit institutions;
- creditors and credit intermediaries;
- providers of crowdfunding service who issue loans to consumers;
- payment institutions and e-money institutions;
- fund managers;
- investment firms;
- insurers;
- collection agencies;
- virtual asset service providers.
The following table gives you an overview of which requirements in relation to internal audit apply to companies operating in the financial sector.
|
Market participants |
Relevant act |
Necessity of internal audit |
Requirements applicable to head of internal audit unit/internal auditor |
|
Banking and credit |
|||
|
Credit institutions (banks) |
Credit Institutions Act, § 59 |
Obligatory |
Certified Internal Auditor |
|
Creditors |
Creditors and Credit Intermediaries Act, § 45 |
Obligatory |
No specific professional level required |
|
Credit intermediaries |
Creditors and Credit Intermediaries Act, § 45 |
Obligatory |
No specific professional level required |
|
Crowdfunding |
|||
|
Consumer credit crowdfunding |
Creditors and Credit Intermediaries Act, § 45 |
Obligatory |
No specific professional level required |
|
Insurance |
|||
|
Insurers |
Insurance Activities Act, § 103 |
Obligatory |
Certified Internal Auditor |
|
Payment services |
|||
|
Payment institutions |
Payment Institutions and |
Obligatory |
Certified Internal Auditor |
|
E-money institutions |
Payment Institutions and |
Obligatory |
Certified Internal Auditor |
|
Investing |
|||
|
Fund managers |
Investment Funds Act, § 349 |
Obligatory if necessary and proportional |
Certified Internal Auditor |
|
Investment firms |
Securities Market Act, § 832 |
Obligatory if necessary and proportional |
Certified Internal Auditor |
|
Virtual asset service |
|||
|
Virtual asset service providers (VASP) |
Money Laundering and Terrorism Financing Prevention Act, §724 |
Obligatory |
Certified Internal Auditor |
|
Collection service |
|||
|
Debt collection agencies |
Forthcoming Credit Collection and Purchasers Act, § 42 |
Obligatory |
Certified Internal Auditor |