The order, which was sent to the companies at end of November, was to "ensure proper business organization" following a breach of requirements, BaFin said in a statement.

Clearstream and Eurex, both subsidiaries of Deutsche Boerse, are to report regularly to BaFin and the Bundesbank on the progress made in remedying the deficiencies, BaFin said but did not give further details.

BaFin has additionally ordered Eurex to take appropriate internal security measures to meet requirements for risk management.

Spokespersons for Eurex and Clearstream said BaFin's announcement relates to audits conducted by the supervisory authority during 2021 on compliance with the minimum requirements for risk management.

For Eurex, the subject of the audits were within the area of IT outsourcing as well as monitoring measures with regard to tax risks through the use of the clearing infrastructure, its spokesperson said. Clearstream's audits were also related to outsourcing requirements, its spokesperson said.

Both Eurex and Clearstream initiated appropriate measures, so internal processes have since been strengthened significantly, the spokespeople added. Remediation plans have been submitted to BaFin, they said.

(Reporting by Emma-Victoria Farr and Tom Sims, editing by Susan Fenton)