Valuable assets in the event of a disruption: Obligations, deadlines and evidence in accordance with Section 23b SGB IV

According to Section 23b Paragraph 2 SGB IV, a disruption in the credit balance occurs as soon as the saved credit can no longer be used appropriately for an exemption in accordance with Section 7c SGB IV. The previously deferred social security contributions and payroll taxes will then become due at the latest, usually at the time of the triggering event. In their circular dated March 31, 2009, last updated in 2024, the central associations of social insurance providers specified which constellations constitute an incident, which calculation rules apply and which evidence is required for an audit of the German pension insurance. The deadline expires as soon as we become aware of it.

This article explains the typical triggers, the interfaces between payroll accounting, insolvency protection and compliance as well as the documentation requirements that must exist in the event of a tax audit. You will learn how to manage credit accounts in an audit-proof manner, which evidence is relevant for the auditors, how the SV-Luft is determined for each calendar year, when the fifth rule according to Section 34 EStG applies and at which points CIVAC takes over the operational effort as a compliance platform and officer-as-a-service. The auditor calls, the evidence is ready. Anyone who leads with this attitude shortens examinations, avoids late payment penalties, eliminates criminal risks according to Section 266a of the German Criminal Code and retains strategic sovereignty over personnel strategy and liquidity planning.

Value credit agreements are regulated in Sections 7b to 7f SGB IV. § 7b SGB IV defines the credit agreement as a written agreement between employer and employee with which wages are saved for a future exemption from work. Section 7c SGB IV specifies the permissible purposes, including care leave according to the Care Leave Act, parental leave according to BEEG, part-time work before retirement as well as longer qualification and sabbatical phases. § 7d SGB IV requires the credit balance to be kept in cash, including the employer's contributions on it, separately from the other business assets, so that an insolvency-proof asset is created.

Central to the analysis of incidents is § 7e SGB IV: If the credit balance exceeds three times the monthly reference amount (2026: around 11,235 euros gross in the old federal states), this applies mandatory insolvency protection. Security is typically provided via trust models, double-sided trust or deposit insurance. § 23b SGB IV finally regulates the treatment of contributions in the event of an incident: If one of the circumstances mentioned there is present, the full amount of the credit must be contributed according to the applicable contribution rates, up to the respective contribution assessment limit, if necessary using the so-called SV-Luft. The central association circular also specifies the sequence of contributions and the treatment of salary components from several years of employment.

For operational implementation, it is worth taking a look at the role of the Compliance Officer, who coordinates the interfaces between HR, financial accounting and the tax department. If you cannot or do not want to fill this role internally, you can order it externally using CIVAC's Officer-as-a-Service model. The model covers the appointment certificate, reporting line to management, regular reporting to the supervisory board and the annual notification obligation to the affected employees. The appointment certificate, signed, filed, verifiable.

In their circular, the leading associations of social insurance providers name six key facts that constitute a major incident. First: the termination of the employment relationship without fully using up the credit balance, for example through termination, termination agreement or retirement. Secondly: the death of the employee, provided that the credit cannot be transferred to surviving dependents or a transfer to the German Federal Pension Insurance in accordance with Section 7f SGB IV does not take place. Third: claiming a disability pension. Fourth: the amicable termination of the credit agreement without an exemption.

Fifth, often overlooked: the inappropriate use. If the credit is paid out for a purpose other than the exemptions mentioned in Section 7c SGB IV, this also constitutes an incident. A payment as a pure special payment or to repay private liabilities also satisfies this requirement. Sixth: the insolvency of the employer without effective insolvency protection. In this case, the management is personally liable, and there is also the risk of offenses under Section 266a of the German Criminal Code (withholding of wages). Changing the provider of the insolvency protection without a seamless handover can actually lead to a disruption if the protection is interrupted or the intrinsic value of the investment cannot be proven.

A trigger that is often underestimated is the so-called intrinsic value: If the market value of the investment falls below the book value, a value adjustment may be necessary. If this is not done, there is a risk of balance sheet corrections and, in extreme cases, accusations of balance sheet manipulation according to Section 331 of the German Commercial Code (HGB). There are also special cases such as transfer of operations according to Section 613a BGB, in which the credit agreement is generally transferred to the purchaser if the purchaser establishes their own insolvency protection. If he does not do this within six months, another incident will occur, which will be borne by the employer taking over. Cross-border postings can also trigger an incident if the employee moves permanently abroad and the German social security relationship ends.

If an accident occurs, the so-called SV air must be determined. This is the difference between the wages actually contributed in a calendar year and the respective contribution assessment limit (2026: 96,600 euros in the West, 96,600 euros in the East in pension and unemployment insurance; 66,150 euros in health and nursing care insurance). Within this SV air, the credit can be contributed without exceeding the assessment limit. Amounts above the SV-Luft remain non-contributory, but still trigger income tax. The SV-Luft must be calculated separately for each calendar year since the start of savings, separately according to health, nursing care, pension and unemployment insurance.

The wage tax is calculated in the month of inflow, usually according to the fifth rule of Section 34 EStG, provided that the requirements for remuneration for several years of activity are met. The leading associations make it clear that the contribution is not divided, but rather in one access for the entire credit. Important: The SV air is calculated according to the calendar year. If there is a change in the contribution assessment limit between the start of savings and the incident, the applicable values ​​must be used, not those applicable in the year of the incident. For employees with multiple jobs, the distribution regulation of Section 22 SGB IV also applies.

For payroll accounting, this means: In the month of the incident, the income tax registration and contribution statements must be corrected accordingly, the ELStAM data must be updated and the social security reports must be filed in accordance with DEÜV (reporting reason 55). Late reporting may result in late payment surcharges in accordance with Section 24 SGB IV of 1% per month or part thereof and, if applicable, a fine in accordance with Section 111 SGB IV of up to 25,000 euros. In addition, there are possible default interest on unpaid wage tax in accordance with Section 233a AO of 0.15% per month. Anyone who carries out the calculation manually risks systematic errors in the SV air allocation over several years of employment and thus additional claims that can arise from the four-year limitation period according to Section 25 SGB IV.

The insolvency protection takes effect as soon as the credit balance exceeds three times the monthly reference amount. With a reference value of 3,745 euros in 2026, the threshold is 11,235 euros. From this amount onwards, a suitable form of security must be chosen. Section 7e Paragraph 2 SGB IV expressly mentions trust models, double-sided trusts, pledging to the employee and insurance-based solutions. Internal group bonds that are not insolvent-proof are expressly excluded, as are balance sheet provisions without external protection. Structures similar to pension funds without formal separation from company assets also do not stand up to scrutiny.

The employer must inform the employee in writing at least annually about the amount of the assets and the chosen form of security. According to Section 7e Paragraph 4 SGB IV, this notification is mandatory and must be presented during a DRV audit. If proof is missing, the assets are not considered insured against insolvency. The result: The pension insurance provider can order immediate additional contributions because the deferral effect no longer applies. In addition, the employee can sue the employer under civil law for insolvency protection and, in an expedited procedure, obtain an injunction that blocks further accumulation of the credit balance.

In practice, the double-sided trust has proven itself because it protects against the insolvency of both the employer and the trustee. The contracts should be audited by a specialist lawyer specializing in social security law, and the trustee must submit proof of impairment at least annually, often in the form of a confirmation by an auditor in accordance with IDW PS 880. CIVAC provides support with templates for trust contracts, annual reports and audit documentation as part of its compliance platform and officer-as-a-service. The templates are stored with the current contribution assessment limits, so that payroll and HR teams do not have to maintain Excel calculations. Audit-proof, documented, § 7e-proof.

In companies that are subject to the Major Accident Ordinance (12th BImSchV), two very different accident terms come together: the accident under labour and social law in the credit balance and the accident under environmental and safety law according to Section 2 No. 7 of the 12th BImSchV. Both regimes must be viewed independently of each other, but must not be mixed in internal risk management. A clearly documented separation of terms protects against misunderstandings in crisis communication and in reporting to supervisory authorities, such as the responsible state trade supervisory authority or the Federal Office for Civil Protection.

The interface becomes practically relevant when an environmental incident leads to a company shutdown and employment relationships are subsequently terminated. The same incident can then trigger both environmental reporting obligations to the responsible state authority and labour law incidents in the credit balance. However, the reporting deadlines differ significantly: While the environmental incident must be reported immediately in accordance with Article 18 of the Seveso III Directive, the payroll department has until the end of the following month to submit the DEÜV report with reporting reason 55. The internal escalation paths must reflect both deadlines so that one report does not overshadow the other and reporting obligations do not pass unnoticed.

For KRITIS operators and Seveso companies, it is therefore recommended that close coordination between the incident officer and the human resources department. A common crisis guide that reflects both regimes avoids duplication of work and closes gaps in the reporting chain. CIVAC provides an integrated crisis guide in the Workspace that combines NIS-2 reporting paths (24-hour early warning, 72-hour follow-up notification) with the employment law credit obligations, so that an incident is mapped in a single escalation matrix. The reporting line is automatically distributed to management, the supervisory board and external representatives without the need to maintain separate email distribution lists.

The German pension insurance checks valuable assets regularly as part of the tax audit in accordance with Section 28p SGB IV, usually every four years. In particular, the following are checked: the written credit balance agreement, the insolvency protection, the annual notifications to the employees, the accounting separation of the credit balance from the other business assets, the correct determination of the SV air in the event of an incident and the timely reporting according to DEÜV reporting reason 55. In addition, there are samples for payouts, value corrections and changes of carrier. In recent years, the DRV has also increasingly examined the plausibility of the valuation methods, especially for accumulating fund investments with volatile price developments.

Specifically, the auditors regularly request: copies of the agreements with signatures of both parties, evidence of the trust contracts, proof of the value of the trust investment (at least annually), pay slips from the month of the incident and a conclusive calculation of the SV air per calendar year since the start of the credit balance. In the event of complaints, there is a risk of additional demands, late payment surcharges and, under certain circumstances, the initiation of administrative offense proceedings. A missing or incomplete annual report regularly leads to significant additional payments because the deferral effect no longer applies retroactively and the contributions then have to be made up at the time of savings.

The CIVAC platform provides 490 audit templates, several of which are specifically for documenting credit balances, appointment certificates and reporting lines. The appointment certificate, signed, filed, verifiable. All evidence is stored in an audit-proof EU data residence and is available on demand. If the auditor makes an ad hoc request, the required documents can be exported in less than ten minutes instead of having to be reconstructed from email archives and file folders. The ISMS according to ISO/IEC 27001:2022 with 93 controls ensures the confidentiality of personal data and ensures that the transfer to external auditors also meets the data protection requirements of Art. 32 GDPR.

As soon as a trigger is recognised, a closely timed sequence of operational steps begins. Step 1: Report to payroll and the compliance function within 24 hours, including categorizing the trigger (termination, death, insolvency, breach of purpose). Step 2: Within 5 working days, determination of the current credit balance, the accrued income and the SV air per calendar year. Step 3: Within 10 working days, preparation of the payroll with the incident statement, application of the fifth rule where permissible, comparison with ELStAM and plausibility check against the previous year.

Step 4: Report according to DEÜV with reporting reason 55 no later than the 15th of the following month. Step 5: Update the personnel file with the end of the agreement, termination date and calculation basis. Step 6: Informing the employee or his heirs about the tax burden, ideally with reference to the tax advice available under Section 34 EStG and any obligations to file an income tax return. Step 7: Filing of all evidence in the audit-proof system and entry in the internal compliance register. Step 8: Informing the management as part of the regular compliance reporting and, if necessary, reporting to the supervisory board if there are any material effects on liquidity.

Anyone who processes this sequence several times a year benefits from standardised workflows with appointment certificates, reporting lines and escalation paths. The CIVAC workspace maps these steps as a checklist with deadline control and significantly reduces the processing time compared to the Excel solution. The SLA for deploying a new balance audit trail is 2 business days instead of the industry standard 2 to 6 weeks. In the event of an audit, several weeks of research becomes a guided query via the compliance cockpit, documented down to the booking level and exportable as a PDF audit package for the DRV or the auditor.

Anyone who fails to contribute in the event of an incident risks several chains of sanctions at the same time. In criminal law, Section 266a StGB applies (withholding wages), which provides for a prison sentence of up to five years in cases of intent; in particularly severe cases up to ten years. In terms of tax law, Section 370 AO (tax evasion) comes into consideration, also with a prison sentence of up to five years, and in the case of particularly serious tax evasion according to Section 370 (3) AO, up to ten years. In terms of administrative offenses, Section 111 SGB IV applies with fines of up to 25,000 euros per violation. In the case of multiple violations, the fine amount can quickly add up to six-figure amounts, especially if several employees are affected.

There are also consequences under organisational law: Section 130 OWiG sanctions the violation of the supervisory obligation in companies with fines of up to 1 million euros for the person responsible and, if necessary, association fines in accordance with Section 30 OWiG. Managing directors and board members are personally liable for compliance with legal obligations if they have not taken appropriate measures to prevent this. A documented compliance management system significantly reduces this risk because it translates the supervisory obligation into understandable processes. Insurers, in turn, are increasingly linking D&O coverage to proof of such systems, so that a lack of documentation also affects insurability.

The reputational damage of a discovered violation often exceeds the financial sanction. Employees, works councils and potential applicants lose trust in the long-term viability of credit models, which indirectly puts a strain on recruiting and employee retention. Clean documentation and transparent handling of incidents are therefore indispensable not only from a legal perspective, but also from a personnel policy perspective. Others run compliance like a filing cabinet. We run it like software. Whoever maintains the filing cabinet is looking in the event of an audit; Anyone who manages compliance like software exports it.

CIVAC bundles the operational steps surrounding value credits in an integrated compliance platform and officer-as-a-service. The workspace contains the relevant templates for credit balance agreements, trust agreements, annual reports, incident statements and DEÜV reports, stored with the current contribution assessment limits and reference values. Appointment certificates, reporting lines and escalation paths are preconfigured so that every action remains auditable. The data is stored on an EU data residence, secured by an ISMS according to ISO/IEC 27001:2022 with 93 controls and through documented technical and organisational measures in accordance with Art. 32 GDPR.

Licence the workspace for your internal representatives, or have our representatives appointed. In the first model, your company retains operational responsibility, but uses the 490 audit templates, the NIS 2 reporting paths (24h early warning, 72h follow-up report) and the ISMS certified according to ISO/IEC 27001:2022. In the second model, experienced CIVAC officers take on the role of compliance officer or incident officer, including reporting obligations to management and the supervisory board. The order SLA is 2 business days instead of the industry standard 2 to 6 weeks. CIVAC currently has 25 representative roles live, so that parallel mandates for data protection, information security or whistleblower protection are also covered from a single source.

Turn reading into a mandate. Write to info@civac.de or use the contact form. We check your credit balance structure, identify possible triggers and ensure that the documentation is ready for DRV audits. You will receive an initial finding and a clear plan for the next steps within two working days. For the subsequent implementation, if you wish, you will immediately receive an external compliance officer with an appointment certificate, reporting line and demonstrable experience in balance checks. Optionally, we bundle the mandate with the function of incident officer, so that you can cover two critical roles from a single source, with a common escalation matrix and uniform reporting line to management.