DDORA & IT Security
9. MaRisk-Novelle und DORA: Digitale Resilienz wird Chefsache 9th MaRisk Amendment and DORA: Digital Resilience Becomes a Board-Level Responsibility
Read More
  • 5 minute read

9th MaRisk Amendment and DORA: Digital Resilience Becomes a Board-Level Responsibility

The draft of the 9th MaRisk amendment systematically integrates the requirements of DORA into the existing MaRisk governance framework without creating a separate national regime. As a result, digital operational resilience is becoming a core management responsibility: ICT risks are no longer viewed solely as an IT security issue but as part of overall bank management, risk strategy, and institution-wide governance.
Read More
DDORA & IT Security
IT-Anforderungen an Finanzunternehmen in Deutschland – ein Überblick über den regulatorischen Rahmen IT Requirements for Financial Institutions in Germany – an overview of the regulatory framework
Read More
  • 7 minute read

IT Requirements for Financial Institutions in Germany – an overview of the regulatory framework

IT regulation in the financial sector is becoming increasingly complex. With DORA, the FinmadiG, the NIS 2 Implementation Act, GDPR, the Cyber Resilience Act, the Data Act and the AI Act, financial institutions face far-reaching requirements regarding digital resilience, third-party risk management and governance. This article provides a structured overview of the current regulatory framework in Germany and at EU level.
Read More
PPodcast
KI-Regulierung in der Praxis: Was die Aufsicht zu KI im Finanzsektor wirklich sehen will | ALLES LEGAL #126 AI Regulation in Practice
Read More
  • 2 minute read

AI Regulation in Practice: What Supervisors Really Expect to See from AI in the Financial Sector | ALLES LEGAL #126

Annerton partner Josefine Spengler explains how supervisory authorities assess AI systems in the financial sector in practice. AI is not treated as a regulatory special case but as an ICT system embedded within existing frameworks, particularly DORA. The focus lies on governance, accountability, traceability and ongoing monitoring. The interaction between DORA and the EU AI Act adds further complexity. The key takeaway: AI is not merely an IT issue – it is a management responsibility.
Read More
LLegal
Von Outsourcing zu Third Party Arrangements: Die neuen EBA-Leitlinien zum Drittparteienmanagement • Teil 1: Überblick über die wichtigsten Neuerungen
Read More
  • 7 minute read

From Outsourcing to Third Party Arrangements: The New EBA Guidelines on Third-Party Risk Management 1/2

On 8 July 2025, the European Banking Authority (EBA) published a new consultation paper on the EBA Guidelines for third-party risk management. The draft goes well beyond the previous Outsourcing Guidelines from 2019. The objective is to establish a harmonised European framework for managing third-party risks, aligned in particular with the Digital Operational Resilience Act (DORA). Part 1 of the analysis highlights the key innovations and main content; a practical assessment will follow in Part 2.
Read More
FFinTech
Neues Buch: Das Recht der digitalen Zahlungsdienstleistungen
Read More
  • 2 minute read

PayTechLaw – now available as a book!

With the title “PayTechLaw – The Law of Digital Payment Services”, a new handbook has been published by C.H. BECK. It is dedicated entirely to the regulatory and civil law framework of digital payments. The editors: Prof. Dr. Carsten Herresthal, LL.M., and Annerton partners Dr. Matthäus Schindele and Frank Müller, LL.M. – all recognized experts in payment services and financial regulatory law. They were supported by a top-class team of authors – including many familiar names from the Annerton environment and beyond.
Read More