BaFin warnings about unauthorised providers: investors' rights

What the warnings mean

The legal basis for the warnings is § 37(4) KWG (German Banking Act), and for crypto-assets additionally § 10(7) KMAG (German Crypto Markets Supervision Act). Under these provisions, BaFin (Federal Financial Supervisory Authority) may inform the public where facts justify the suspicion that a company is operating without the required authorisation. The warning is a simple administrative act (schlichtes Verwaltungshandeln) and does not establish a legal violation with binding effect; the companies concerned can challenge it in court, and BaFin occasionally withdraws warnings. For investors, a warning is nonetheless a weighty indication, and it marks the point in time from which a risk was publicly known.

One recurring name is “Quantum AI”. BaFin warned about websites under this name as early as August 2022, again in February and March 2025, and in July 2025 once more about a further site that redirected users to a trading platform called “Open AI”. The pattern is typical: when a site is shut down, a successor with the same appearance emerges under a new domain.

Cases of identity misuse now make up a large proportion of the warnings. The perpetrators copy the names, legal notice (Impressum) details and design of genuine, supervised companies. In February 2026, fraudsters sent out fixed-term deposit offers from a sender address modelled on the domain of Raisin (WeltSparen); the company itself had nothing to do with it. SMBC Bank EU AG was affected in a similar way with fixed-term deposit offers, as was Börse Stuttgart, when a crypto platform called “Revolvo” passed itself off as its offering. In August 2026, BaFin warned about the domains 212trading.online and 212trading.pro, which were based on the name of the broker Trading 212.

Offers aimed at people who have already suffered losses are particularly insidious. On 14 September 2026, BaFin warned about finanzforensik.com. The operators promised to recover lost crypto-assets, presented themselves as a “cooperation partner of BaFin” and used the details of an existing company in their legal notice without authorisation. Anyone who has been a victim once is thus approached a second time.

Claims against the provider

As regards the provider itself, the legal position for investors is favourable. In established case law, the BGH (Federal Court of Justice) regards the authorisation requirement under § 32(1) sentence 1 KWG as a protective law (Schutzgesetz) within the meaning of § 823(2) BGB (German Civil Code), which specifically protects the individual investor (BGH, judgment of 21.4.2005 – III ZR 238/03; judgment of 11.7.2006 – VI ZR 341/04). Anyone who conducts banking business or provides financial services without authorisation is therefore liable to the investor for damages.

This liability applies not only to the company but also to its managing directors personally. Unauthorised operation is a criminal offence under § 54 KWG even if committed negligently, and § 14 StGB (German Criminal Code) links responsibility to the position as a corporate officer. The BGH has recently clarified that the position as an officer alone is not sufficient and that fault must be established in the individual case. However, an internal allocation of responsibilities does not fully relieve an officer: they remain under a duty of supervision and must intervene if there are indications of irregularities (BGH, judgment of 9.11.2023 – III ZR 105/22).

The bank and BaFin as defendants

Taking action against the bank through which the money was transferred is considerably more difficult. As a rule, investors initiated the payments themselves, so the refund rule for unauthorised payment transactions (§ 675u BGB) does not apply. According to case law, the bank has a duty to warn only exceptionally, where misuse is objectively obvious (cf. BGH, judgment of 6.5.2008 – XI ZR 56/07). In the case of individual transfers to a professionally presented platform, this threshold is rarely reached.

Claims against BaFin itself are generally ruled out. Under § 4(4) FinDAG (Act Establishing the Federal Financial Supervisory Authority), it performs its tasks exclusively in the public interest, so that it owes no official duties to individual investors. The European Court of Justice (CJEU) has approved this model (judgment of 12.10.2004 – C-222/02, “Paul”), and the Higher Regional Court (OLG) of Munich confirmed it in state liability proceedings against BaFin (notice order of 21.10.2024 – 1 U 1121/24 e).

Assessment

A BaFin warning is not a judgment, but it is a clear signal. In legal terms, investors who have suffered losses are in a strong position against providers operating without authorisation and the persons responsible for them, because liability under § 823(2) BGB in conjunction with § 32 KWG has long been well established. The real difficulty lies in enforcement, as the operators are often based abroad and are difficult to reach. Anyone affected should secure payment records, contracts and correspondence, file a criminal complaint and keep an eye on the limitation period, which is generally three years from the end of the year in which the claim and the debtor became known (§§ 195, 199 BGB). Offers promising recovery in return for advance payment should be treated with the greatest caution.

This article is for general information purposes only and does not replace advice in an individual case.