BaFin has published the final version of the Minimum Requirements for Risk Management of Investment Firms (WpI MaRisk). It was issued as Circular 09/2026 (WA), dated 24 August 2026, and will apply from 1 January 2027. It was preceded around a year ago by a public consultation, compared with which BaFin has significantly streamlined the text and made substantive adjustments in several areas. Below, we outline the key elements of the final WpI MaRisk.
Table of Contents
Purpose, legal basis and scope of application
The WpI MaRisk sets out a flexible, practical framework for the business organisation and risk management of investment firms. Its legal basis includes, in particular, the German Investment Firm Act (WpIG), the German Securities Trading Act (WpHG) and Commission Delegated Regulation (EU) 2017/565; the Circular also implements relevant EBA Guidelines on internal governance and on the suitability of members of management bodies.
It applies to medium-sized and small investment firms, including their foreign branches. Large investment firms remain subject to the supervisory framework under sections 25a and 25b of the German Banking Act (KWG) and the more detailed requirements of Circular 06/2026 (BA) – Minimum Requirements for Risk Management (MaRisk).
The key structural principle is double proportionality: the requirements distinguish between small and medium-sized investment firms, while their specific implementation additionally depends on the nature, scale, complexity and risk profile of the business activities. As part of a risk inventory, the managing directors must regularly prepare an overall risk profile and assess the materiality of risks to clients, the market and the firm, other risks and liquidity risks.
Risk-bearing capacity, capital planning and strategies
Medium-sized investment firms must ensure that their risk coverage potential continuously covers their material risks and must establish a risk-bearing capacity framework approved by the managing directors for this purpose. Small and medium-sized investment firms must also have a multi-year capital planning process which, in addition to a baseline scenario, takes into account at least one adverse scenario and is consistent with operational business planning.
The managing directors must define a viable business strategy that is reviewed regularly, as well as a corresponding risk strategy setting out the firm’s risk appetite; for small investment firms, the strategy process may be designed in a simpler manner.
Every firm must establish appropriate organisational and operational structures, implement risk management processes and a compliance function and, where proportionate, establish a risk management function and an internal audit function. For firms that hold client money or client securities, distribute complex products or operate an MTF/OTF, an independent risk management function will generally be considered appropriate and proportionate.
The compliance function must be independent of the operational units and, as a general rule, report directly to the managing directors. A compliance officer, whose role may also be performed by a managing director, reports to the managing directors at least annually and forwards the report to the internal audit function.
Internal audit: proportionality with clear limits
Investment firms must establish an independent internal audit function where this is appropriate and proportionate. Where this would be disproportionate, the function may be performed by a managing director or may be omitted altogether. Disproportionality is generally assumed for firms with fewer than ten employees – but not for firms holding client money or client securities, offering complex products or operating an MTF/OTF.
The internal audit function operates on the basis of a risk-oriented audit plan to be approved annually and reports annually to the managing directors on material findings.
Outsourcing
Outsourcing occurs where a firm transfers activities to another undertaking which it would otherwise perform itself. Material outsourcing arrangements must be identified on the basis of a risk analysis, and every firm must establish a central outsourcing management function with an outsourcing register.
In the case of outsourcing arrangements of significant importance, such as the outsourcing of the risk management, compliance or internal audit function, firms must carefully assess how integration into the risk management framework can be ensured. The management responsibilities of the managing directors can never be outsourced, and long outsourcing chains may restrict the firm’s ability to exercise effective oversight.
Trading activities and tied agents
The key requirement for trading activities (BTH module) is a clear separation between trading, risk management, settlement and control up to the level of the managing directors. However, this separation may be dispensed with for trading activities that are not relevant from a risk perspective. Trading transactions must be continuously monitored independently of the trading function and reflected in risk management without delay. For tied agents (BTV module), the following applies: each individual agent constitutes a separate outsourcing arrangement; the firm must obtain evidence of the agent’s professional suitability and systematically monitor their activities, for example by means of spot checks, computer-assisted controls or on-site inspections.
The status of a tied agent is only established once the assumption of liability has been notified to BaFin.
Risk management processes, stress tests and risk reporting
Every firm must establish processes for identifying, managing and monitoring material risks. Medium-sized investment firms must also regularly conduct stress tests and incorporate the results into their assessment of risk-bearing capacity. More stringent requirements apply to firms with relevant own-account trading or underwriting activities or that hold client money or client securities.
The managing directors must be regularly informed about the firm’s business situation and risk position; reports must be meaningful, show stress test results and risk concentrations and be capable of being prepared on an ad hoc basis.
Liquidity risks and the risk of a disorderly wind-down
Firms must remain able to meet their payment obligations at all times and identify liquidity shortages at an early stage. Medium-sized investment firms must ensure that their liquid assets are sufficient under stress scenarios. In addition, medium-sized investment firms must regularly determine the period within which and the costs at which an orderly wind-down of their business activities could take place.
Strengthening the principle of proportionality
A consistent feature of the final WpI MaRisk is the strengthening of the principle of proportionality: while large investment firms are excluded from its scope and remain subject to the (ultimately stricter) MaRisk, numerous requirements of the WpI MaRisk apply from the outset only to medium-sized investment firms, and their specific implementation always depends on the nature, scale, complexity and risk profile of the business activities. This is particularly evident in relation to internal audit: for firms with fewer than ten employees (including managing directors and taking outsourced functions into account), a dedicated internal audit unit will generally be considered disproportionate, meaning that the performance of these tasks may be omitted.
Conclusion
The final WpI MaRisk provides a comprehensive framework tailored to small and medium-sized investment firms for business organisation and risk management, combining general requirements with specific provisions for trading activities, tied agents, outsourcing and individual types of risk. Compared with the consultation version published around a year earlier, BaFin has significantly streamlined the text.
Affected firms should adapt their internal policies and processes in good time before the rules take effect on 1 January 2027.
