With the consultation on the 9th amendment to the Minimum Requirements for Risk Management (MaRisk), launched on 1 April 2026, a noticeable shift in supervisory approach is emerging: away from regulatory over-specification and towards a stronger focus on material risks and a renewed emphasis on the principle of proportionality. Even at first glance, it is clear that this is not merely a continuation of existing requirements or the addition of new regulatory topics, but rather a targeted step towards further developing the supervisory framework.
Table of Contents
Comments on the draft may be submitted to BaFin and the Deutsche Bundesbank until 8 May 2026.
This article provides an initial overview and marks the beginning of a series in which we will accompany the MaRisk revision in detail. In the coming weeks, we will examine the key topics – from ESG and governance to DORA – individually and analyse their practical implications in depth.
Three reform strands, one overarching objective
The amendment is not a selective update but consolidates several regulatory developments into a coherent framework. At its core, three strands converge:
- the findings of the comprehensive MaRisk review,
- the incorporation of the supervisory communication of 26 November 2024 (in particular relief measures for smaller institutions), and
- the implementation of new requirements arising from the BRRD/CRD VI implementation act (BRUBEG), published on 30 March 2026, as well as the EBA Guidelines.
This results in a significantly reoriented framework that consolidates existing requirements while integrating new topics.
New institutional classification as a “game changer”
A key lever of the amendment is the classification of institutions, which will in future largely determine the depth of regulatory requirements.
A distinction is made between:
- very small institutions (total assets up to €1 billion),
- small and non-complex institutions (SNCIs) (total assets up to €5 billion), and
- less significant institutions (LSIs).
The significantly increased thresholds define supervisory expectations more clearly and are likely to enable a substantial number of institutions to benefit from regulatory relief. Based on a risk-focused supervisory approach, such relief is permissible where justified by the institution’s specific risk profile.
At the same time, supervisors draw a clear distinction from the European supervisory regime: significant institutions (SIs) will be excluded from the scope of MaRisk and remain under the direct supervision of the European Central Bank. The primary objective is to consistently avoid regulatory duplication.
Key messages: less detail, greater managerial discretion
The amendment follows a clear guiding principle: moving away from detailed rules towards a more principles-based approach.
Streamlining of the framework
MaRisk is being significantly streamlined. Redundant provisions and content already regulated by law are reduced, detailed requirements are replaced by general principles, and previously fragmented requirements are consolidated. Overall, this results in a more coherent and interoperable framework.
Focus on risks and materiality
Risk-oriented management is placed at the centre. Institutions are expected to allocate resources more effectively to material risks rather than implementing regulatory requirements in a purely formalistic manner. This marks a clear paradigm shift.
Proportionality as a core principle
The principle of proportionality is significantly strengthened. Opening clauses are clarified, expanded and made more practical. Requirements can therefore be tailored more closely to the size, business model and risk profile of institutions – an approach that particularly benefits smaller institutions.
However, this also creates challenges: the use of proportionality and regulatory relief requires a thorough assessment of institution-specific risks and appropriate documentation that enables third parties to understand both the justification for and the consistency of such relief with the institution’s risk profile.
Key regulatory focus areas
In addition to structural adjustments, the amendment addresses key regulatory topics, including:
- stronger integration of ICT risks in the context of DORA,
- incorporation of ESG risks into risk management, and
- adjustments in governance and internal control frameworks.
A consistent effort is evident to bundle requirements, reduce overlaps and focus on key control mechanisms.
Assessment and outlook
The 9th MaRisk amendment represents a significant recalibration of the supervisory approach: away from detailed prescriptiveness and formal compliance towards greater proportionality, enhanced risk orientation and increased flexibility for institutions.
Overall, the amendment is a welcome step. However, it remains to be seen to what extent the principles outlined in the consultation draft will be reflected in the final version.
Finalisation of the amendment is expected in the second half of 2026. The ongoing consultation phase therefore provides an important window for stakeholders to position themselves and adapt early to the new MaRisk logic.
