Bafin updates KAMaRisk

Restrictions for registered AIF management companies: Whilst key sections of the previous version of KAMaRisk (in particular governance, risk management and lending processes) explicitly covered AIF management companies subject to registration (also known as sub-threshold AIFMs), the Consultation Draft is now directed exclusively at capital management companies holding a licence within the meaning of section 17 of the German Investment Fund Act (Kapitalanlagegesetzbuch – KAGB). The previous explicit references to sub-threshold AIFMs are to be removed (see section 2.1).

Emphasis on proportionality: Bafin emphasises the principle of proportionality, which was already enshrined in the previous version of the KAMaRisk. It follows, in particular, that for capital management companies managing AIFs that grant loans or invest in unsecuritised loan receivables, less stringent requirements regarding organisational structure and operational processes may apply if this investment activity constitutes only a minor part of the respective AIF’s portfolio. By contrast, more stringent requirements apply where lending or investment in loans forms a key focus of the respective investment activity.

Practical implication: AIFMs should therefore assess which parts of their existing KAMaRisk framework remain relevant under the Consultation Draft and where the greater emphasis on proportionality opens up scope for organisational simplification. In our view, this is likely to provide additional scope for less complex structures, particularly with regard to organisational and operational arrangements.

Alignment with the FRiG: The main focus of the Consultation Draft is the completely revised section 5 on loans and unsecuritised loan receivables. Here, Bafin is implementing the new statutory requirements of the FRiG in the KAGB into administrative practice. In this respect, there has already been a shift in terminology from the old term ‘granting of cash loans’ to the new statutory terminology of ‘lending’.

In connection with investment in unsecuritised loan receivables, section 5.1(2) of the Consultation Draft states that 'section 29a of the KAGB and the requirements of this section shall apply accordingly’. In this respect, we believe the question arises as to whether this is intended to refer to the whole of section 5 or only to section 5.1. The wording of section 2(4) – “…specific minimum requirements for the risk management of AIFs that grant loans or invest in unsecuritised loan receivables (section 5)” – could, in our view, suggest that the reference is intended to cover the whole of section 5. The current wording carries the risk of differing interpretations in practice. An explicit clarification from Bafin therefore appears necessary.

a) Indirect lending and special-purpose lending entities

In the event of indirect lending via a third party within the meaning of section 1(19)(24b)(b), alternative 1, of the KAGB, the Consultation Draft provides, in section 5.1(7), for relief for the relevant capital management company under certain conditions. To avoid difficulties in distinguishing between the two and to ensure practical relevance, the BVI – Bundesverband Investment und Asset Management e.V. (Bundesverband Investment und Asset Management e.V. - BVI) proposes that Bafin develop case studies or criteria to determine when indirect lending is to be distinguished from an investment in unsecuritised loan receivables.

A prerequisite for this is that the capital management company has verified that the third party is subject to supervisory requirements regarding organisational structures which comply with the provisions of section 5.1 of the Consultation Draft. If the third party is an AIF management company authorised to grant loans, a CRR credit institution or a company authorised under section 32(1) of the German Banking Act (KWG), the company may generally assume, without the need for such verification, that this requirement is met.

However, these simplifications do not apply to lending via special-purpose lending vehicles. The AIF or the AIF management company controlling the special-purpose lending vehicle must ensure that the special-purpose lending vehicle complies with all the requirements of KAMaRisk. The same applies if the portfolio management of an AIF that grants loans is outsourced to another company.

In our view, it is unclear whether a special-purpose lending company – and, in the case of the outsourcing of portfolio management for an AIF that grants loans, the contracted company – must comply with all the requirements of KAMaRisk or merely those set out in section 5. In our opinion, the latter would be preferable. The current wording carries the risk of differing interpretations in practice. To avoid any uncertainty in interpretation, an explicit clarification from BaFin appears warranted.

It is also noteworthy that Bafin classifies lending as an investment decision and thus assigns it to the portfolio management function (explanatory notes to section 4.3, point 2). According to Annex I of AIFMD 2.0, lending is to be classified merely as an ancillary task within the framework of collective asset management and, consequently, is not to be attributed to portfolio management or risk management. Bafin recently set out this understanding in its draft Circular 07/2026 (WA) (Konsultation 07/2026: Rundschreiben zu Änderungen im Kapitalanlagegesetzbuch durch das Fondsrisikobegrenzungsgesetz). However, the current draft amendment to the KAMaRisk does not yet reflect this approach – a gap which, in the BVI’s view, should be closed in the interests of consistent supervisory practice.

b) Process requirements and credit risk assessment

In terms of content, the key point is that the existing architecture of the KAMaRisk, which is based on banking credit processes, is to be significantly streamlined. In the Consultation Draft, the requirements for lending and loan processing are structured much more clearly according to the individual process steps. In particular, these cover creditworthiness assessment, ongoing processing, early risk detection, intensive monitoring and the handling of non-performing loans (see section 5.3). 

Bafin nevertheless maintains its high standards for the assessment of credit risk. Particular emphasis is placed on the borrower’s ability to service the debt, scenario analyses, sector and, where applicable, country risks, foreign currency aspects, and the valuation and ongoing monitoring of collateral (see section 5.2).

Practical implications: In light of the proposed amendments to KAMaRisk, capital management companies managing AIFs that grant loans and/or invest in unsecuritised loan receivables should review their existing procedures and processes at an early stage in order to identify any need for adjustments in good time. In several respects, the Consultation Draft moves away from requirements that have hitherto been typical of the banking sector and makes the regulatory framework more practical overall.

Holistic approach: Going forward, Bafin views risk management as moving towards a holistic approach in which ESG risks must also be explicitly incorporated. Both in assessing materiality and in designing the internal control system (risk-bearing capacity framework, risk management and control processes, processes within the structural and operational organisation), the impacts of ESG risks must be taken into account appropriately and in line with scientific findings.

ESG as a risk driver: ESG risks are not established as a separate risk category but – in line with MaRisk – are understood as risk drivers that permeate all traditional types of risk (see section 4.1.4.). This alignment with MaRisk is also evident in the fact that Bafin uses the term ‘ESG risks’ – as established there – rather than ‘sustainability risks’. Bafin, however, uses the latter term in its guidance note on managing sustainability risks. Such differences in terminology need to be resolved during the consultation process.

Practical implication: The explicit inclusion of ESG risks is consistent and makes it clear that capital management companies must, in future, integrate ESG aspects and their interactions with traditional types of risk much more consistently into risk analysis, management and reporting. ESG is thus no longer treated merely as a reporting topic, but as an integral part of risk management.

Simplification of the governance structure: The Consultation Draft also contains important simplifications from an organisational perspective. Whilst the independence of the risk control function from fund management remains unaffected, Bafin is relaxing the previous strict requirements to the extent that the risk control function does not necessarily have to be separated from the back-office division right up to executive management level. Instead, the same organisational unit may in future be responsible for both back-office operations and risk control.

Practical implications: This distinction provides capital management companies with additional flexibility in their organisational structure, without compromising the regulatory requirement for the independence of key control functions.

DORA scope: In parallel, Bafin is clarifying its expectations regarding IT governance and DORA. In the Consultation Draft, Bafin has removed any duplication with the DORA Regulation (EU) 2022/2554 (DORA). Outsourced or third-party ICT services as defined in Article 3(21) of DORA, which are subject to third-party ICT risk management in accordance with Articles 28–30 of DORA, also fall outside the scope of KAMaRisk (section 10).

Legal certainty: The clarifications made in KAMaRisk as a result of the DORA framework are a step in the right direction to avoid double burdens on capital management companies. With regard to the classification of third-party ICT services (outsourcing/procurement of services) and the DORA Regulation, clarification from Bafin would be desirable.

Practical implications: In future, capital management companies must structure their outsourcing and ICT governance even more clearly in line with the respective regulatory regimes. Reducing bureaucracy in this area is not achieved through fewer obligations, but through clearer allocation of responsibilities. In practice, questions of demarcation remain, particularly in the case of mixed services comprising both specialist and ICT components.

The consultation period has now expired, but overall the amendments are welcome development. It will now be crucial for Bafin to carefully evaluate the comments received and to consistently maintain the approach taken in the final version. If this is achieved, the revised KAMaRisk could significantly enhance the attractiveness of Germany as a fund location, particularly for credit-related strategies.