Cybersecurity Risk Management and Strategy Disclosure	12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]	Policies and risk management The bank’s policies and controls support risk reduction and mitigation for potential negative impacts. Information security risk is managed as an operational risk under the bank’s Operational Risk Management Framework. The Chief Security Office is responsible for and executes security matters against the Operational Risk Management Framework and leverages the results of its various instruments, such as risk appetite, while Operational Risk Management provides oversight, review, and challenge. Measures for the further reduction of material residual risks may include policy changes or policy amendments at divisional or group level, as well as prioritized investment and accelerated implementation of risk-mitigating activities. Security risks are assessed on a continual basis through analysis of internal and external cyber events, including events at peer institutions, monitoring of the threat environment, and discussion in various forums. The annual risk and control assessment process evaluates diverse risk scenarios, encompassing service disruption, system misuse, data distortion, asset/data destruction, data disclosure, financial theft, and non-adherence to regulatory policies and laws. This comprehensive analysis incorporates potentially affected stakeholders, including clients and suppliers, and assesses the external threat landscape by leveraging industry-standard frameworks, such as MITRE ATT&CK (standardized framework to assess cyberattacks). When evaluating control suites and residual risk positions, the process considers contextual data and controls, such as major events, threat assessments, findings, scenario analysis, control metrics, lessons learned, events at peer institutions, read-across, regulatory expectations, and remediation activities. Additional risk reviews are conducted for emerging developments, with results evaluated against the bank's control capabilities. As an integral part of this assessment, internal security subject matter experts provide risk evaluations, supported by areas like Legal, Compliance, or Group Data Privacy, as needed. These evaluations are subsequently reviewed and challenged by risk subject matter experts to determine the final risk position. Concurrently, senior information security experts from all divisions and functions assess the group’s exposure within their respective domains. These divisional and functional assessments are also subjected to review and challenge by risk subject matter experts, establishing the final risk positions across the organization. Deutsche Bank maintains an ISO 27001-compliant information security management system (ISMS) to protect information assets. The system facilitates the comprehensive identification, assessment, and mitigation of risks through the holistic integration of security controls across the entire workforce, operational processes, and technological infrastructure. It defines the foundational objectives and principles of the bank's security architecture and strategy, consistent with its overarching governance framework for policies and operational risk management directives. The ISMS is comprehensively supported by a structured suite of policies, procedures, and controls that clearly define responsibilities for all employees, designated security roles, and third parties. It also sets forth objectives and processes for security functions, including access management, threat intelligence, and incident response. Continuous monitoring and iterative improvement are integral to the ISMS, ensuring adaptability to evolving threats and vulnerabilities. The framework undergoes an annual strategic review, with all updates approved by the Group CSO. Its established processes are centrally governed and applied throughout the bank. Unit-specific guidelines further detail operational implementation, demonstrating a strong commitment to established security standards. The bank’s ISMS has been certified by an accredited certification body according to ISO 27001 for all information security domains defined within that standard since 2012. To maintain its ISO 27001 certification, the bank performs a full recertification process every three years, with the latest taking place in 2024, and included the upgrade of its ISMS to the 2022 version of ISO 27001. Furthermore, the bank performs an annual surveillance audit designed to ensure compliance between certification intervals with the most recent surveillance audit conducted in 2025. Actions and resources To address the evolving threat landscape, Deutsche Bank employs a variety of prevention methods and controls. These include, for example, network security, identity and access management, endpoint and data security (including data classification and leakage prevention), threat intelligence, cyber hygiene, and encryption solutions. These preventive controls are backed by a threat-driven detection setup and a robust incident response process. Deutsche Bank has established a holistic information security program with appropriate staffing, tooling, and processes. The bank continually reviews and enhances its information security controls through multiple layers of technology, including databases, infrastructure, devices, and applications. This is complemented by organizational controls and security training and awareness. The purpose of this layered approach is to strengthen end-to-end protection by utilizing multiple opportunities to prevent, detect, respond to, and recover from cyber threats. Deutsche Bank leverages various mechanisms to self-identify areas for improvements and control enhancements. These encompass comprehensive security testing including red teaming and threat-led penetration testing, security problem management, and lessons learned. Deutsche Bank´s Group Audit provides independent, risk-based assurance by periodically assessing the design and operating effectiveness of key information security controls within the ISMS. The bank’s overall information security program is evaluated on a regular basis by third-party organizations which include external auditors, regulators and security testing organizations. The bank actively shares security best practices and threat information with national and international security organizations, government authorities, and peer organizations. These relationships help ensure that the bank’s security technology and procedures reflect current financial industry best practices and keep pace with the evolving threat environment. As digitalization advances, the need to enhance societal literacy on information security topics grows. Deutsche Bank addresses this need by educating and informing through informational materials, publicly provided via its dedicated client-facing security website covering security-related topics and highlighting information security threats (including those related to emerging technologies like AI, deepfakes and phishing via quick response (QR) codes), best practices for secure behavior, and links to relevant resources. To strengthen trust, additionally, an overview of the bank's protective measures is provided. Client interaction also encompasses presentation of security topics at client events and responses to client inquiries on security topics by its client relationship managers. Deutsche Bank requires yearly mandatory information security baseline training for all employees and eligible contractor staff. This training encompasses the content of the information security policy, the process to report security incidents or any other security-related concerns, as well as important and current security threats. To ensure relevance and to comply with internal standards, the training is updated at least on a yearly basis. For Deutsche Bank employees, failure to complete this training and late completion can result in disciplinary consequences. In 2025, a learning completion rate of 99,66% was achieved for the e- learning-based mandatory information security training, compared to 99,65% in 2024. Deutsche Bank’s security incident management provides ongoing coverage for security events that may affect the bank, its clients and business partners, or employees. The bank’s Cyber Threat Operations Centers located in Asia Pacific, Europe and USA support global and group-wide detection of threats and response to incidents 24/7. The related management and reporting processes performed with involvement of subject matter experts, such as divisional CISOs, Compliance, Legal, Group Communications and Group Data Privacy, are designed to enable a quick and effective response to cyberattacks and information security threats. The objective is to minimize the risk of impacts on Deutsche Bank and to use insights gained from incident handling to continuously improve the bank’s processes. Information security risks of third parties are managed by Deutsche Bank through a combination of capabilities, implementing a comprehensive approach to mitigate these risks. Key components include the bank’s global third-party risk management program, which is designed to identify, monitor, and mitigate risks associated with third-party engagements. In combination, the bank requires adherence to an information security policy with specific security controls for third parties, which include incident notification requirements. Third parties are also re-assessed periodically based on their criticality (annually or bi-annually) to seek continued assurance that control requirements are being met. Additionally, third parties are also engaged in response to specific threats and incidents to assess any impact on the bank. As in prior years, Deutsche Bank in 2025 experienced attacks on computer systems, including attacks aimed at obtaining unauthorized access to confidential company or client information, damaging or interfering with company data, resources, or business activities, or otherwise exploiting vulnerabilities in its infrastructure, including attacks that occurred along the bank’s supply chain. The bank, however, did not experience any material effect on its business strategy, results of operation, or financial condition due to an information security incident, including attempted cyberattacks. Consequently, the bank continued to invest in security risk mitigation. In 2025, Deutsche Bank kept advancing its security capabilities through a multitude of programs encompassing the breadth of the cyber security domain. A few specific examples are programs such as enhanced threat detection and prevention, advanced identity management capabilities, and embedding security as part of infrastructure platform modernization and simplification. The bank also continues to monitor and evaluate emerging technologies to anticipate and prepare for future risk.
Cybersecurity Risk Management Processes Integrated [Flag]	true
Cybersecurity Risk Management Processes Integrated [Text Block]	The bank’s policies and controls support risk reduction and mitigation for potential negative impacts. Information security risk is managed as an operational risk under the bank’s Operational Risk Management Framework. The Chief Security Office is responsible for and executes security matters against the Operational Risk Management Framework and leverages the results of its various instruments, such as risk appetite, while Operational Risk Management provides oversight, review, and challenge. Measures for the further reduction of material residual risks may include policy changes or policy amendments at divisional or group level, as well as prioritized investment and accelerated implementation of risk-mitigating activities. Security risks are assessed on a continual basis through analysis of internal and external cyber events, including events at peer institutions, monitoring of the threat environment, and discussion in various forums. The annual risk and control assessment process evaluates diverse risk scenarios, encompassing service disruption, system misuse, data distortion, asset/data destruction, data disclosure, financial theft, and non-adherence to regulatory policies and laws. This comprehensive analysis incorporates potentially affected stakeholders, including clients and suppliers, and assesses the external threat landscape by leveraging industry-standard frameworks, such as MITRE ATT&CK (standardized framework to assess cyberattacks). When evaluating control suites and residual risk positions, the process considers contextual data and controls, such as major events, threat assessments, findings, scenario analysis, control metrics, lessons learned, events at peer institutions, read-across, regulatory expectations, and remediation activities. Additional risk reviews are conducted for emerging developments, with results evaluated against the bank's control capabilities. As an integral part of this assessment, internal security subject matter experts provide risk evaluations, supported by areas like Legal, Compliance, or Group Data Privacy, as needed. These evaluations are subsequently reviewed and challenged by risk subject matter experts to determine the final risk position. Concurrently, senior information security experts from all divisions and functions assess the group’s exposure within their respective domains. These divisional and functional assessments are also subjected to review and challenge by risk subject matter experts, establishing the final risk positions across the organization. Deutsche Bank maintains an ISO 27001-compliant information security management system (ISMS) to protect information assets. The system facilitates the comprehensive identification, assessment, and mitigation of risks through the holistic integration of security controls across the entire workforce, operational processes, and technological infrastructure. It defines the foundational objectives and principles of the bank's security architecture and strategy, consistent with its overarching governance framework for policies and operational risk management directives. The ISMS is comprehensively supported by a structured suite of policies, procedures, and controls that clearly define responsibilities for all employees, designated security roles, and third parties. It also sets forth objectives and processes for security functions, including access management, threat intelligence, and incident response. Continuous monitoring and iterative improvement are integral to the ISMS, ensuring adaptability to evolving threats and vulnerabilities. The framework undergoes an annual strategic review, with all updates approved by the Group CSO. Its established processes are centrally governed and applied throughout the bank. Unit-specific guidelines further detail operational implementation, demonstrating a strong commitment to established security standards. The bank’s ISMS has been certified by an accredited certification body according to ISO 27001 for all information security domains defined within that standard since 2012. To maintain its ISO 27001 certification, the bank performs a full recertification process every three years, with the latest taking place in 2024, and included the upgrade of its ISMS to the 2022 version of ISO 27001. Furthermore, the bank performs an annual surveillance audit designed to ensure compliance between certification intervals with the most recent surveillance audit conducted in 2025.
Cybersecurity Risk Management Third Party Engaged [Flag]	true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag]	true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag]	false
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]	As in prior years, Deutsche Bank in 2025 experienced attacks on computer systems, including attacks aimed at obtaining unauthorized access to confidential company or client information, damaging or interfering with company data, resources, or business activities, or otherwise exploiting vulnerabilities in its infrastructure, including attacks that occurred along the bank’s supply chain. The bank, however, did not experience any material effect on its business strategy, results of operation, or financial condition due to an information security incident, including attempted cyberattacks.
Cybersecurity Risk Board of Directors Oversight [Text Block]	Governance Responsibility for security matters at Deutsche Bank sits within the Chief Security Office. The Group Chief Security Officer (CSO) has delegated authority from the Management Board, including approval of the security policies and the security strategy for the Deutsche Bank Group. The Group CSO reports directly to the Chief Technology, Data, and Innovation Officer, a member of the Management Board. The Management Board is accountable for overseeing the implementation of the information security framework, with oversight from the Supervisory Board. There are multiple mechanisms in place for the Group CSO to escalate security issues directly to the Management Board if required. Deutsche Bank’s Group CSO has served in various information security roles for more than 20 years. These include positions as global Chief Information Security Officer (CISO)/CSO for three different large European financial institutions and a partner position at a global strategy and consulting firm, leading security work for financial service clients. The Group Chief Security Officer is supported by information security experts at various seniority levels across the bank to ensure that security requirements are met from regional, divisional, and technical perspectives. All information security activities are overseen by two dedicated governance forums established and chaired by the Group CSO: the Group IT Security Council (interfacing with the bank’s IT units) and the Group Information Security Council (interfacing with the bank’s business and infrastructure divisions). The independent operational risk management function for information security is represented in both forums. Both forums provide advice on the security strategy and oversee the progress and performance of key information security deliverables, the remediation status of information security- related audit findings, information security incidents, and the information security posture of Deutsche Bank Group against defined targets. In the event of critical issues, members are assigned with specific actions by the Group CSO according to their responsibility. In addition to the Group CSO-led governance forums, the Technology & Information Security Risk Committee (TISRC) oversees technology and information security risks, ensuring alignment with the bank's strategic objectives. The committee is chaired by the Chief Technology, Data and Innovation Officer, and vice chaired by the Group CSO and the Head of Group Technology Infrastructure, with a mandatory attendance requirement for the Chief Information Officers and veto power for the risk function represented by both the Global Head of Operational Risk Management and the Global Head of IT Risk and Information Security Risk. Security indicators and reporting provided to the bank’s relevant governance forums support appropriate security risk awareness and decision-making. The comprehensive metrics framework maintained by the Chief Security Office is underpinned by an extensive data set, allowing for various dedicated views. The Management Board and the Supervisory Board receive a quarterly information security risk posture report, as well as ad-hoc information if required. Furthermore, the Group CSO provides regular updates on material topics relating to security to the Supervisory Board’s committee responsible for Technology, Data and Innovation., Strategy The Chief Security Office develops the bank’s group-wide security strategy and oversees its global implementation and operationalization via the organizational setup, governance, and implemented security policies. The security strategy, which is reviewed on a regular basis, incorporates developments in the threat landscape, technology, the regulatory environment, the bank’s corporate and IT strategy, and other internal and external parameters. The approach provides comprehensive and layered security controls. The Chief Security Office works closely with the bank´s divisions to enable alignment with the security-by-design approach throughout bank-wide programs and initiatives. Security investments are prioritized and adjusted from a threat-driven perspective, leveraging the regular review and assessment of the maturity of the bank’s security implementation. A key element of the bank’s security strategy is to foster responsibility and active awareness among Deutsche Bank staff. By embedding these principles into daily practices, Deutsche Bank aims to bring about long-term behavioral changes that help mitigate risks and enhance overall security posture. The bank’s security culture and awareness campaign, Mission Security, continuously updated to reflect emerging threats and best practices and communicated to all employees worldwide, reinforces these efforts. Another way the bank strengthens security culture is by periodically conducting simulations and testing exercises, including phishing simulation and mandatory training.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]	the Supervisory Board’s committee responsible for Technology, Data and Innovation.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]	The Management Board and the Supervisory Board receive a quarterly information security risk posture report, as well as ad-hoc information if required. Furthermore, the Group CSO provides regular updates on material topics relating to security to the Supervisory Board’s committee responsible for Technology, Data and Innovation.
Cybersecurity Risk Role of Management [Text Block]	Responsibility for security matters at Deutsche Bank sits within the Chief Security Office. The Group Chief Security Officer (CSO) has delegated authority from the Management Board, including approval of the security policies and the security strategy for the Deutsche Bank Group. The Group CSO reports directly to the Chief Technology, Data, and Innovation Officer, a member of the Management Board. The Management Board is accountable for overseeing the implementation of the information security framework, with oversight from the Supervisory Board. There are multiple mechanisms in place for the Group CSO to escalate security issues directly to the Management Board if required. Deutsche Bank’s Group CSO has served in various information security roles for more than 20 years. These include positions as global Chief Information Security Officer (CISO)/CSO for three different large European financial institutions and a partner position at a global strategy and consulting firm, leading security work for financial service clients. The Group Chief Security Officer is supported by information security experts at various seniority levels across the bank to ensure that security requirements are met from regional, divisional, and technical perspectives. All information security activities are overseen by two dedicated governance forums established and chaired by the Group CSO: the Group IT Security Council (interfacing with the bank’s IT units) and the Group Information Security Council (interfacing with the bank’s business and infrastructure divisions). The independent operational risk management function for information security is represented in both forums. Both forums provide advice on the security strategy and oversee the progress and performance of key information security deliverables, the remediation status of information security- related audit findings, information security incidents, and the information security posture of Deutsche Bank Group against defined targets. In the event of critical issues, members are assigned with specific actions by the Group CSO according to their responsibility. In addition to the Group CSO-led governance forums, the Technology & Information Security Risk Committee (TISRC) oversees technology and information security risks, ensuring alignment with the bank's strategic objectives. The committee is chaired by the Chief Technology, Data and Innovation Officer, and vice chaired by the Group CSO and the Head of Group Technology Infrastructure, with a mandatory attendance requirement for the Chief Information Officers and veto power for the risk function represented by both the Global Head of Operational Risk Management and the Global Head of IT Risk and Information Security Risk. Security indicators and reporting provided to the bank’s relevant governance forums support appropriate security risk awareness and decision-making. The comprehensive metrics framework maintained by the Chief Security Office is underpinned by an extensive data set, allowing for various dedicated views. The Management Board and the Supervisory Board receive a quarterly information security risk posture report, as well as ad-hoc information if required. Furthermore, the Group CSO provides regular updates on material topics relating to security to the Supervisory Board’s committee responsible for Technology, Data and Innovation.,
Cybersecurity Risk Management Positions or Committees Responsible [Flag]	true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]	Responsibility for security matters at Deutsche Bank sits within the Chief Security Office. The Group Chief Security Officer (CSO) has delegated authority from the Management Board, including approval of the security policies and the security strategy for the Deutsche Bank Group. The Group CSO reports directly to the Chief Technology, Data, and Innovation Officer, a member of the Management Board. The Management Board is accountable for overseeing the implementation of the information security framework, with oversight from the Supervisory Board. There are multiple mechanisms in place for the Group CSO to escalate security issues directly to the Management Board if required. Deutsche Bank’s Group CSO has served in various information security roles for more than 20 years. These include positions as global Chief Information Security Officer (CISO)/CSO for three different large European financial institutions and a partner position at a global strategy and consulting firm, leading security work for financial service clients. The Group Chief Security Officer is supported by information security experts at various seniority levels across the bank to ensure that security requirements are met from regional, divisional, and technical perspectives. All information security activities are overseen by two dedicated governance forums established and chaired by the Group CSO: the Group IT Security Council (interfacing with the bank’s IT units) and the Group Information Security Council (interfacing with the bank’s business and infrastructure divisions). The independent operational risk management function for information security is represented in both forums. Both forums provide advice on the security strategy and oversee the progress and performance of key information security deliverables, the remediation status of information security- related audit findings, information security incidents, and the information security posture of Deutsche Bank Group against defined targets. In the event of critical issues, members are assigned with specific actions by the Group CSO according to their responsibility. In addition to the Group CSO-led governance forums, the Technology & Information Security Risk Committee (TISRC) oversees technology and information security risks, ensuring alignment with the bank's strategic objectives. The committee is chaired by the Chief Technology, Data and Innovation Officer, and vice chaired by the Group CSO and the Head of Group Technology Infrastructure, with a mandatory attendance requirement for the Chief Information Officers and veto power for the risk function represented by both the Global Head of Operational Risk Management and the Global Head of IT Risk and Information Security Risk.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]	Deutsche Bank’s Group CSO has served in various information security roles for more than 20 years. These include positions as global Chief Information Security Officer (CISO)/CSO for three different large European financial institutions and a partner position at a global strategy and consulting firm, leading security work for financial service clients. The Group Chief Security Officer is supported by information security experts at various seniority levels across the bank to ensure that security requirements are met from regional, divisional, and technical perspectives. All information security activities are overseen by two dedicated governance forums established and chaired by the Group CSO: the Group IT Security Council (interfacing with the bank’s IT units) and the Group Information Security Council (interfacing with the bank’s business and infrastructure divisions). The independent operational risk management function for information security is represented in both forums. Both forums provide advice on the security strategy and oversee the progress and performance of key information security deliverables, the remediation status of information security- related audit findings, information security incidents, and the information security posture of Deutsche Bank Group against defined targets. In the event of critical issues, members are assigned with specific actions by the Group CSO according to their responsibility. In addition to the Group CSO-led governance forums, the Technology & Information Security Risk Committee (TISRC) oversees technology and information security risks, ensuring alignment with the bank's strategic objectives. The committee is chaired by the Chief Technology, Data and Innovation Officer, and vice chaired by the Group CSO and the Head of Group Technology Infrastructure, with a mandatory attendance requirement for the Chief Information Officers and veto power for the risk function represented by both the Global Head of Operational Risk Management and the Global Head of IT Risk and Information Security Risk.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]	The Management Board and the Supervisory Board receive a quarterly information security risk posture report, as well as ad-hoc information if required. Furthermore, the Group CSO provides regular updates on material topics relating to security to the Supervisory Board’s committee responsible for Technology, Data and Innovation.,
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag]	true

Cybersecurity Risk Management and Strategy Disclosure

12 Months Ended

Dec. 31, 2025

Cybersecurity Risk Management, Strategy, and Governance [Line Items]

Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Policies and risk management

The bank’s policies and controls support risk reduction and mitigation for potential negative impacts. Information security risk is

managed as an operational risk under the bank’s Operational Risk Management Framework. The Chief Security Office is

responsible for and executes security matters against the Operational Risk Management Framework and leverages the results of

its various instruments, such as risk appetite, while Operational Risk Management provides oversight, review, and challenge.

Measures for the further reduction of material residual risks may include policy changes or policy amendments at divisional or

group level, as well as prioritized investment and accelerated implementation of risk-mitigating activities.

Security risks are assessed on a continual basis through analysis of internal and external cyber events, including events at peer

institutions, monitoring of the threat environment, and discussion in various forums.

The annual risk and control assessment process evaluates diverse risk scenarios, encompassing service disruption, system

misuse, data distortion, asset/data destruction, data disclosure, financial theft, and non-adherence to regulatory policies and

laws. This comprehensive analysis incorporates potentially affected stakeholders, including clients and suppliers, and assesses

the external threat landscape by leveraging industry-standard frameworks, such as MITRE ATT&CK (standardized framework to

assess cyberattacks). When evaluating control suites and residual risk positions, the process considers contextual data and

controls, such as major events, threat assessments, findings, scenario analysis, control metrics, lessons learned, events at peer

institutions, read-across, regulatory expectations, and remediation activities. Additional risk reviews are conducted for emerging

developments, with results evaluated against the bank's control capabilities.

As an integral part of this assessment, internal security subject matter experts provide risk evaluations, supported by areas like

Legal, Compliance, or Group Data Privacy, as needed. These evaluations are subsequently reviewed and challenged by risk

subject matter experts to determine the final risk position. Concurrently, senior information security experts from all divisions

and functions assess the group’s exposure within their respective domains. These divisional and functional assessments are also

subjected to review and challenge by risk subject matter experts, establishing the final risk positions across the organization.

Deutsche Bank maintains an ISO 27001-compliant information security management system (ISMS) to protect

information assets. The system facilitates the comprehensive identification, assessment, and mitigation of risks through

the holistic integration of security controls across the entire workforce, operational processes, and technological

infrastructure. It defines the foundational objectives and principles of the bank's security architecture and strategy,

consistent with its overarching governance framework for policies and operational risk management directives.

The ISMS is comprehensively supported by a structured suite of policies, procedures, and controls that clearly define

responsibilities for all employees, designated security roles, and third parties. It also sets forth objectives and processes

for security functions, including access management, threat intelligence, and incident response.

Continuous monitoring and iterative improvement are integral to the ISMS, ensuring adaptability to evolving threats and

vulnerabilities. The framework undergoes an annual strategic review, with all updates approved by the Group CSO. Its

established processes are centrally governed and applied throughout the bank. Unit-specific guidelines further detail

operational implementation, demonstrating a strong commitment to established security standards.

The bank’s ISMS has been certified by an accredited certification body according to ISO 27001 for all information

security domains defined within that standard since 2012. To maintain its ISO 27001 certification, the bank performs a

full recertification process every three years, with the latest taking place in 2024, and included the upgrade of its ISMS to

the 2022 version of ISO 27001. Furthermore, the bank performs an annual surveillance audit designed to ensure

compliance between certification intervals with the most recent surveillance audit conducted in 2025.

Actions and resources

To address the evolving threat landscape, Deutsche Bank employs a variety of prevention methods and controls. These include,

for example, network security, identity and access management, endpoint and data security (including data classification and

leakage prevention), threat intelligence, cyber hygiene, and encryption solutions. These preventive controls are backed by a

threat-driven detection setup and a robust incident response process.

Deutsche Bank has established a holistic information security program with appropriate staffing, tooling, and processes. The

bank continually reviews and enhances its information security controls through multiple layers of technology, including

databases, infrastructure, devices, and applications. This is complemented by organizational controls and security training and

awareness. The purpose of this layered approach is to strengthen end-to-end protection by utilizing multiple opportunities to

prevent, detect, respond to, and recover from cyber threats.

Deutsche Bank leverages various mechanisms to self-identify areas for improvements and control enhancements. These

encompass comprehensive security testing including red teaming and threat-led penetration testing, security problem

management, and lessons learned. Deutsche Bank´s Group Audit provides independent, risk-based assurance by periodically

assessing the design and operating effectiveness of key information security controls within the ISMS. The bank’s overall

information security program is evaluated on a regular basis by third-party organizations which include external auditors,

regulators and security testing organizations.

The bank actively shares security best practices and threat information with national and international security organizations,

government authorities, and peer organizations. These relationships help ensure that the bank’s security technology and

procedures reflect current financial industry best practices and keep pace with the evolving threat environment.

As digitalization advances, the need to enhance societal literacy on information security topics grows. Deutsche Bank addresses

this need by educating and informing through informational materials, publicly provided via its dedicated client-facing security

website covering security-related topics and highlighting information security threats (including those related to emerging

technologies like AI, deepfakes and phishing via quick response (QR) codes), best practices for secure behavior, and links to

relevant resources. To strengthen trust, additionally, an overview of the bank's protective measures is provided. Client

interaction also encompasses presentation of security topics at client events and responses to client inquiries on security topics

by its client relationship managers.

Deutsche Bank requires yearly mandatory information security baseline training for all employees and eligible contractor staff.

This training encompasses the content of the information security policy, the process to report security incidents or any other

security-related concerns, as well as important and current security threats. To ensure relevance and to comply with internal

standards, the training is updated at least on a yearly basis. For Deutsche Bank employees, failure to complete this training and

late completion can result in disciplinary consequences. In 2025, a learning completion rate of 99,66% was achieved for the e-

learning-based mandatory information security training, compared to 99,65% in 2024.

Deutsche Bank’s security incident management provides ongoing coverage for security events that may affect the bank, its

clients and business partners, or employees. The bank’s Cyber Threat Operations Centers located in Asia Pacific, Europe and

USA support global and group-wide detection of threats and response to incidents 24/7. The related management and

reporting processes performed with involvement of subject matter experts, such as divisional CISOs, Compliance, Legal, Group

Communications and Group Data Privacy, are designed to enable a quick and effective response to cyberattacks and

information security threats. The objective is to minimize the risk of impacts on Deutsche Bank and to use insights gained from

incident handling to continuously improve the bank’s processes.

Information security risks of third parties are managed by Deutsche Bank through a combination of capabilities, implementing a

comprehensive approach to mitigate these risks. Key components include the bank’s global third-party risk management

program, which is designed to identify, monitor, and mitigate risks associated with third-party engagements. In combination,

the bank requires adherence to an information security policy with specific security controls for third parties, which

include incident notification requirements.

Third parties are also re-assessed periodically based on their criticality (annually or bi-annually) to seek continued

assurance that control requirements are being met. Additionally, third parties are also engaged in response to specific

threats and incidents to assess any impact on the bank.

As in prior years, Deutsche Bank in 2025 experienced attacks on computer systems, including attacks aimed at obtaining

unauthorized access to confidential company or client information, damaging or interfering with company data, resources, or

business activities, or otherwise exploiting vulnerabilities in its infrastructure, including attacks that occurred along the bank’s

supply chain. The bank, however, did not experience any material effect on its business strategy, results of operation, or financial

condition due to an information security incident, including attempted cyberattacks.

Consequently, the bank continued to invest in security risk mitigation. In 2025, Deutsche Bank kept advancing its

security capabilities through a multitude of programs encompassing the breadth of the cyber security domain. A few

specific examples are programs such as enhanced threat detection and prevention, advanced identity management

capabilities, and embedding security as part of infrastructure platform modernization and simplification. The bank also

continues to monitor and evaluate emerging technologies to anticipate and prepare for future risk.

Cybersecurity Risk Management Processes Integrated [Flag]

true

Cybersecurity Risk Management Processes Integrated [Text Block]