The Freename Forum

An internet service provider may be obliged to set up a DNS block at the request of the Federal Financial Supervisory Authority (BaFin) if a company provides financial services without a licence. This was decided by the VG Frankfurt/Main (judgement of 23.10.2024 - Ref. 7 K 800/22.F).

The plaintiff is one of the largest internet service providers worldwide. The defendant, Future Traders Corporation Ltd. based in the Netherlands, operates an exclusively German-language website on the internet at future-traders.com, through which it offers customers the brokerage of shares and bonds. By decision dated 25 March 2021, the defendant BaFin prohibited the defendant in accordance with Section 37 (1) sentence 1 KWG from operating the custody business and providing investment brokerage and advice, as it did not have the licence required under Section 32 (1) KWG. In addition, it instructed the defendant to cease or refrain from any advertising for its business activities, in particular via the website, which is aimed at persons domiciled or regularly resident in the Federal Republic of Germany. During BaFin's investigations, it became known that the defendant had copied the website of another market participant without authorisation and had used the fake site europaischeakademiefurfinanzfragen.de for its own market presence. In addition, the defendant had falsified a BaFin consultation letter in order to legitimise a payment request to its customers. The defendant did not comply with BaFin's instructions and the decision of 25 March 2021 is final. By decision of 20 August 2021, BaFin instructed the plaintiff to set up a DNS block for the defendant's .com domain. It also ordered the plaintiff to redirect its customers to a prohibition order against the defendant, which BaFin had published on its website, when entering the domain. The plaintiff was involved in the unauthorised business of the defendant by providing the services it offered as an internet provider within the meaning of Section 37 (1) sentence 4 KWG. The instruction was intended to prevent or at least make it more difficult for the defendant to continue its unauthorised business and to inform interested parties about the violation of the German Banking Act. BaFin issued identical notices to several other internet providers based in the Federal Republic of Germany.

The plaintiff then filed an action on 18 March 2022 and demanded that the decision of 20 August 2021 be revoked. § Section 37 para. 1 sentence 1 no. 1 KWG is not a constitutionally compliant authorisation basis for ordering a DNS block. Neither is such a block expressly mentioned therein, nor does Section 37 KWG fulfil the citation requirement. Furthermore, Section 37 para. 1 sentence 1 no. 1 KWG is not sufficiently specific with regard to the ordering of a DNS block. The ordered blocking was materially unlawful because it was an error of judgement vis-à-vis the plaintiff. BaFin had not exhausted all possible and reasonable measures to call in the defendant. The order to set up a DNS block was also not proportionate; it was not suitable to prevent the unauthorised transactions of the defendant. It was also not necessary for this purpose. In the opinion of BaFin, a warning on the defendant's website - which also occurred here - was sufficient for other market participants. A difference to the present constellation is not recognisable. Finally, the order to set up a DNS block was also not appropriate in view of the many encroachments on fundamental rights (Art. 12, Art. 5, Art. 10 GG, net neutrality). The same applies to the information obligation imposed on the plaintiff.

The Administrative Court of Frankfurt/Main upheld the action and revoked the decision of 20 August 2021, albeit with restrictions. According to Section 37 para. 1 sentence 1 no. 1 KWG, BaFin can order the immediate cessation of business operations and the immediate winding up of these transactions vis-à-vis the company or the members of its executive bodies if banking transactions are carried out or financial services are provided without the licence required under Section 32 KWG. According to § 37 para. 1 sentence 4 KWG, these powers also exist vis-à-vis the company involved in the initiation, conclusion or settlement of the transactions. As an internet or access provider, the plaintiff was involved in the unauthorised transactions of the defendant without its knowledge by enabling users to access the defendant's website. The ordering of a DNS block is a measure that is generally permissible on the basis of Section 37 (1) sentence 1 KWG within the scope of the dutiful exercise of discretion. It is true that the plaintiff has to concede that the definition of the offence in Section 37 para. 1 KWG is very broad with regard to the criterion of being involved. However, the structure of the provision as a discretionary provision ensures that proportionality considerations are taken into account in the decision-making process when examining any measures on the basis of Section 37 (1) sentences 1 and 4 KWG. In this respect, the ordering of a DNS block does not fail due to a lack of certainty in Section 37 para. 1 KWG. Nor does a violation of the citation requirement of Article 19 (1) sentence 2 of the German Basic Law preclude the ordering of a DNS block, as none of the fundamental rights affected by the DNS block are subject to the barrier of the citation requirement.

In the case in dispute, however, the establishment of a DNS block was not proportionate. BaFin had not made sufficient efforts to end the infringement by the defendant based in the Netherlands with measures that would have been equally - if not more - effective. In particular, it had not endeavoured to gain knowledge of the host provider for the defendant's website and, if necessary, to order measures against it. As the party making the defendant's website available on its server, the host provider would not only be involved in the defendant's unauthorised business. Action against the host provider would also be more effective, as this would ensure that the website no longer exists and could no longer be accessed via a VPN or by simply renaming the site. The plaintiff, as a non-interferer, could only be ordered to set up a DNS block as a last resort if measures against the interferers were not promising. The court allowed the appeal due to its fundamental importance, so it can be assumed that the legal dispute will be continued in the second instance.

The judgement of the VG Frankfurt of 23.10.2024 (Ref. 7 K 800/22.F) can be found (in German) at:
https://www.rv.hessenrecht.hessen.de/bs ... E240001433