Bafin publishes MaRisk for small and medium-sized securities firms
Written by
EU RegCORE Client Alert | German Regulatory Developments
On 24 August 2026, the Federal Financial Supervisory Authority (‘Bafin’) published the Minimum Requirements for the Risk Management of investment firms (‘WpI MaRisk’) for small and medium-sized investment firms.Bafin press release available here.Show Footnote The publication follows on from the consultation carried out in the spring/summer of this year.See also the PwC Legal Client Alert dated 18 May 2026, available here.Show Footnote
The WpI MaRisk will come into force on 1 January 2027. Until then, small and medium-sized investment firms are subject to the MaRisk for credit institutions; they may take into account the amendments contained in the 9th MaRisk amendment during the transitional period. Large investment firms must apply the MaRisk for credit institutions.Available here.Show Footnote
Changes compared with the draft version
The provisions relating to the compliance function have been fundamentally revised (AT 4.4.2 of the WpI MaRisk). The purpose of the compliance function is no longer limited to advising and supporting senior management in complying with key legal requirements. In addition, the compliance function must work towards the implementation of effective procedures and controls to counteract the risks arising from non-compliance with legal regulations (marginal no. 1, clause 2, AT 4.4.2 of the WpI MaRisk).
The outsourcing requirements have also been tightened (AT 9 of the WpI MaRisk). The internal audit department of the outsourcing firm must regularly verify compliance with the requirements, and the relevant audit findings must be communicated (marginal no. 4, clause 5, AT 9 of the WpI MaRisk). This explicit obligation to verify compliance was absent from the draft version. Furthermore, it must be ensured that, in the event of further outsourcing to a subcontractor, the outsourcing provider remains accountable to the outsourcing firm (marginal no. 8, clause 3, AT 9 of the WpI MaRisk). However, the formal requirements for the outsourcing agreement have been relaxed in the case of significant outsourcing: here, the text form is sufficient (marginal no. 7, clause 1, AT 9 of the WpI MaRisk).
Outlook
From 1 January 2027, the WpI MaRisk will introduce new, specific standards for small and medium-sized investment firms. Affected investment firms should make the relevant and necessary adjustments at an early stage in order to avoid risks and comply with regulatory requirements. This will strengthen risk control and investor protection in the long term.
