Business ethics and lawful conduct

Compliance

By reason of its statutory promotional mandate, public opinion is particularly important to Rentenbank. The impeccable conduct of all the bank’s executive officers and employees is an indispensable prerequisite for the success of the bank’s activities. To this end, the Management Board and all employees live out a compliance culture as expressed particularly in the bank’s Mission Statement and Codes of Conduct, and supplemented with internal control processes designed to ensure lawful conduct.

Code of Conduct

Rentenbank has adopted a Code of Conduct for all employees. As the foundation of a lawful, ethical, sustainable corporate culture, the Code of Conduct demands lawful, ethical, and sustainable action on the part of all employees. The prevention of corruption is an especially important aspect of the Code of Conduct. With regard to the preventive combatting of corruption, id est, the offering and acceptance of bribes and benefits, Rentenbank takes a zero-tolerance approach to all forms of corruption. Violations are punished with disciplinary measures and potentially also criminal prosecution. There have been no such violations in the past years.

The Code of Conduct is concretised by rules of conduct accessible to all employees in the bank’s intranet, particularly regarding the acceptance and giving of gifts and invitations (Gifts Guideline), the handling of conflicts of interest, the prevention of fraud and other criminal acts, and the prevention of money laundering and terrorist financing. If misconduct or criminal acts are suspected, employees are able to inform their supervisor and/or the Compliance Officer or Anti-Money Laundering Officer in confidence. If they prefer, they can also provide anonymous tips to an external ombudsperson.

The members of the Management Board are subject to a special Code of Conduct that particularly comprises fundamental principles of conduct in relation to conflicts of interest, rules governing the acceptance and giving of gifts and invitations, lecturing activities, dealings in financial markets, side-line activities and volunteering.

Prevention of money laundering and other criminal acts, and sanctions

The bank has designated an Anti-Money Laundering Officer in charge of preventing money laundering, terrorist financing, and other criminal acts. The Anti-Money Laundering Officer is organisationally positioned directly beneath the Management Board and reports directly to it. The various risks related to money laundering, terrorist financing, other criminal acts, and sanctions, including customer risks and business partner risks, as well as product, process, and transaction risks, are assessed in risk assessments prepared annually or on an ad-hoc basis. Particular attention may be given to risk-minimising factors such as Rentenbank’s special business model as a promotional bank in Germany and Europe and the granting of loans via local banks by the on-lending method.

Another important element of money laundering prevention relates to compliance with due diligence obligations and the identification of contractual partners (know-your-customer principles). All procedures and processes required for this purpose are followed and any suspected cases are reported immediately to the Financial Intelligence Unit (FIU) by the Anti Money Laundering Officer. No cases of suspicious activity were reported in relation to money laundering and terrorism financing and no other criminal acts are known to have occurred in 2024. Furthermore, there were no sanction violations in 2024.

Digital resilience: data protection and information security

As a bank, we are well aware of the growing challenges and risks in an increasingly digitalised world. We place the highest priority on protecting the information of our customers and business partners and on preventing any disruptions to our business operations. We are likewise conscious of the imperative need for effective data protection. We strive to ensure robust digital resilience as a means to counter the growing threats of cyber-attacks, technical outages, and unforeseeable emergencies. This resilience is needed to earn the trust of our customers and business partners and guarantee the security of our business processes.

Our digital resilience is based on integrated processes linking information security with emergency management, the management of third parties, and risk management. Information security protects the sensitive data of our customers and business partners from unauthorised access and guarantees the integrity, authenticity, confidentiality, and availability of our systems. We invest continually in state-of-the-art technologies and security standards in order to be prepared for cyber-attacks and other threats. Our emergency management team ensures that we can react quickly to crisis situations or emergencies so that we can continue to support our own operations, as well as our customers and business partners. The emergency management system comprises both technical contingency plans and clear communication structures. Our risk management function assesses all potential digital risks and implements preventive measures to minimise these risks and control their effects on the bank.

In the area of data protection, on the other hand, we place a high priority on protecting personal data. To this end, we have integrated compliance with the data protection regulations of the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and other relevant regulations into our operational processes. Rentenbank’s data protection team possesses legal and technical expertise to ensure that data protection is effectively addressed from different perspectives. This mixture ensures that Rentenbank’s data protection system fulfils the relevant standards while also being practicable. Our processes to identify and report data protection incidents are continuously monitored, assessed, and improved.

Another important aspect of our approach to digital resilience is to continually raise the awareness of our employees to the importance of digital security. We ensure that all employees are trained on the subject of our digital security guidelines and potential threats. By means of these awareness-raising measures, we create a vigilant, responsibility-conscious team of workers who can react quickly and correctly in the event of any incidents. This makes an important contribution to risk minimisation.

The responsibility for our digital resilience lies with multiple departments that work closely together to ensure the security and stability of our bank. Our IT Security Department sees to it that our technical systems are protected against attacks and our Risk Management team assesses and manages all relevant risks. Our emergency and crisis management team ensures that we can react quickly and effectively to emergencies, disruptions, or crisis situations. All employees receive regular training. Furthermore, the central emergency management team and decentralised emergency response teams conduct emergency drills on a regular basis in order to guarantee a high level of preparedness and resilience at all levels of the bank.