Bafin Publishes WpI MaRisk

Background

Since the German Investment Firms Act (Wertpapierinstitutsgesetz, WpIG) entered into force, the MaRisk, originally developed for institutions subject to the German Banking Act (Kreditwesengesetz, KWG), have continued to apply mutatis mutandis to small and medium-sized investment firms, taking into account the principle of proportionality. Pending the introduction of specific requirements, the supervisory authorities relied on this application of the MaRisk (mutatis mutandis). In the absence of specific requirements, this served as an interim supervisory solution but left investment firms facing recurring uncertainty as to which bank-specific requirements applied to them and to what extent.

The WpI MaRisk marks the transition to a specific regulatory framework for the proper business organisation and risk management of small and medium-sized investment firms. Rather than continuing to rely on rules originally developed for the KWG regime, the new requirements are tailored to the distinct supervisory architecture established by the WpIG, Directive (EU) 2019/2034 (IFD) and Regulation (EU) 2019/2033 (IFR).

Consultation Process

The publication of the WpI MaRisk was preceded by a multi-stage consultation process. Bafin’s initial draft, published in August 2025, drew considerable criticism from parts of the financial services industry. Market participants argued, in particular, that the draft transferred bank-specific prudential requirements too broadly to investment firms and did not sufficiently reflect the distinct and proportionate supervisory regime established by the IFD, IFR and WpIG. Other concerns focused on the anticipated implementation burden and specific requirements relating to capital planning and stress testing, control functions, outsourcing management and the assessment of the risk of a disorderly wind-down.

In response, Bafin published a substantially revised and streamlined second consultation draft in May 2026. The revised draft addressed many of the concerns raised by the industry, reduced the complexity of the framework and aligned its requirements more closely with the diverse business models and risk profiles of small and medium-sized investment firms. It marked a clear shift towards a more principles-based and proportionate approach.

Bafin has repeatedly highlighted the development of the WpI MaRisk as a key example of a more proportionate regulation approach. This ambition is also reflected in the final WpI MaRisk. Proportionality operates on two levels: the WpI MaRisk distinguish between small and medium-sized investment firms, providing simplifications for small investment firms, while also calibrating the scope and intensity of individual requirements to the nature, scale, complexity and risk profile of the relevant business activities.

The final WpI MaRisk therefore consolidate the direction established by the second consultation draft and introduce a framework more closely tailored to the particular characteristics of small and medium-sized investment firms.
 

Key Requirements

The WpI MaRisk cover, among other matters, the risk inventory, business and risk strategies, capital planning and risk management processes. They also set out requirements for the risk management and compliance functions, internal audit and risk reporting, together with specific provisions on trading activities, tied agents, liquidity risk and outsourcing.

A distinctive feature of the WpI MaRisk is its treatment of the risk of a disorderly wind-down. Bafin has clarified that the relevant requirements do not oblige investment firms to prepare recovery or resolution plans. Rather, investment firms must determine the time required to achieve an orderly wind-down and assess the associated costs.

The WpI MaRisk also clearly delineate the outsourcing requirements under AT 9 from the DORA framework. In line with the current MaRisk under Circular 06/2026 (BA), ICT services within the meaning of Article 3(21) of Regulation (EU) 2022/2554 (DORA) that are subject to the ICT third-party risk management requirements under Articles 28 to 30 DORA are excluded from the scope of AT 9, irrespective of whether they are outsourced or otherwise procured from an external provider. This prevents overlapping requirements while promoting consistency between the different supervisory regimes.
 

Outlook

Although the provisions of the WpI MaRisk are more proportionate and more closely tailored to the specific characteristics of small and medium-sized investment firms than the MaRisk previously applied mutatis mutandis; their implementation is nevertheless likely to require many investment firms to review and adjust their existing processes, responsibilities and documentation.

Therefore, small and medium-sized investment firms should make effective use of the remaining implementation period by conducting a structured gap analysis and developing a clear roadmap for any necessary adjustments. Key areas of focus should include the firm’s regulatory classification and the availability of proportionality-based simplifications, governance and control functions, capital and liquidity planning, the risk of a disorderly wind-down, and the delineation between outsourcing management under AT 9 and ICT third-party risk management under DORA.

A more detailed analysis of the new WpI MaRisk requirements will follow shortly.