A large financial loss does not automatically constitute a liability judgement
According to a media report dated 25 September 2026, a total of around 95 million euros was transferred to overseas accounts at the private bank Fideuram on the instructions of its then chairman of the board. The report is based on information from insiders; according to this, around 53 million euros were recovered. Too little is publicly known about the specific internal authorisations to establish a breach of duty on the part of individual persons. Furthermore, the legal assessment of the Italian facts is not governed by German company law.
Nevertheless, this situation provides an opportunity to examine the duties of German management. Under Section 43 of the German Limited Liability Companies Act (GmbHG), managing directors of a GmbH owe the company the diligence of a prudent businessman. Section 93 of the German Stock Corporation Act (AktG) applies to members of the executive board of an AG. Liability for damages requires, amongst other things, a breach of duty and resulting damage. Whether a specific control system was appropriate depends on the size, payment volume and risk profile of the company. The law does not indiscriminately require two signatures for every bank transfer.
Two independent sets of eyes must verify
In the case of larger, unusual or cross-border payments, a second authorised person should verify the recipient, account details, underlying transaction and authorisation. It is crucial that this person does not merely confirm the instruction, but verifies it with the person actually authorised to give the instruction via a known, separate channel of communication. The telephone number provided in a message or a seemingly familiar voice is not sufficient for this purpose: both may form part of a deception.
The dual-control principle must be implemented both technically and organisationally. Clear financial limits, separate roles for setting up and approving payees, additional checks when bank details change, and documented exceptions prevent time pressure from leading to a unilateral decision. Even senior management should not be able to circumvent these rules through an informal directive. Rather, a claim of special confidentiality is a reason to use the established escalation procedure.
Liability risks also arise from gaps in controls
Senior management must establish appropriate controls, define responsibilities and verify their effectiveness. For listed public limited companies, Section 91(3) of the German Stock Corporation Act (AktG) expressly requires an appropriate and effective internal control and risk management system. Where large sums can be paid out without independent verification, the question arises as to whether the organisation and monitoring of payment processes were sufficient. However, compliance with the dual-control principle neither guarantees protection against fraud nor automatically excludes liability. The circumstances of the individual case are decisive.
Conclusion
Companies should review their payment authorisation processes against realistic fraud scenarios. Who is authorised to add new payees? Who verifies an alleged instruction from a manager via an independent channel? And who halts the payment if the verification fails? These questions need to be addressed before the next urgent transfer is made, not as part of a subsequent damage analysis.
Key points in brief
- Managerial liability requires a specific breach of duty and resulting damage; it does not automatically follow from the reported fraud.
- In the case of high-risk payments, the dual-control principle requires an independent check and verification via a recognised channel.
- Control procedures must function even under time pressure and in the face of instructions from senior management.
