Bafin Publishes WpI MaRisk: New Supervisory Framework for Small and Medium Investment Firms

On 24 August 2026, Bafin published its long-awaited Circular 09/2026 (WA) on the Minimum Requirements for Risk Management of Investment Firms (WpI MaRisk).

The new rules target small and medium-sized investment firms as defined by the German Investment Firm Act (Wertpapierinstitutsgesetz — WpIG). These firms must implement the WpI MaRisk requirements by 1 January 2027, applying the proportionality principle and available opt-out clauses. The compliance deadline marks the end of the longstanding practice under which these firms applied the MaRisk for credit institutions — a framework designed primarily for traditional banking and lending — only “by analogy.”

Small and medium investment firms will now benefit from a standalone rulebook that is tailored to securities business models and gives full effect to the proportionality principle enshrined in Section 40 WpIG.

Beyond refining proportionality, the WpI MaRisk sets out how investment firms must address client risk, market risk, and liquidity risk in line with Section 45 WpIG. Medium-sized firms, for example, must establish an internal process to ensure adequate risk-bearing capacity — a requirement that does not apply to small firms.

Large investment firms are unaffected. They remain subject to Circular 06/2026 (“Minimum Requirements for Risk Management – MaRisk”) dated 30 June 2026.

Risk Inventory as the Starting Point for Risk Management

The risk inventory serves as the foundation for designing an investment firm’s risk-bearing capacity and risk management processes under the WpI MaRisk. Firms must assess risks — mirroring the MaRisk approach — according to their impact on the firm’s asset, earnings, or liquidity position, and must evaluate ESG risk drivers and risk concentrations. Small and medium investment firms are expected to address the following risk categories in their risk inventory:

• Wind-down risks, namely:
  • Risks to clients (“RtC”)
  • Risks to markets (“RtM”)
  • Risks to the firm (“RtF”)
• Liquidity risks
• Other risks

Unlike the MaRisk, the WpI MaRisk does not designate any risk categories as inherently material for investment firms. Information and communication technology risks (ICT risks) must be explicitly included in the risk inventory.

Medium-sized firms face an additional obligation: they must assess the risk of disorderly wind-down, factoring in the firm’s legal form, business model, business and risk strategy, and the scale and complexity of its activities.

Small firms may conduct their materiality assessment on a purely qualitative basis. Medium-sized firms, by contrast, may face significant process and methodology adjustments — particularly from the requirement to explicitly account for disorderly wind-down risk, ESG risk drivers, and ICT risks.

Every investment firm must also manage operational risk through appropriate mechanisms, such as systematic loss-event recording. This may generate additional implementation effort for certain firms.

Risk-Bearing Capacity, Capital Planning, and Stress Testing

Both small and medium firms must project future capital needs over a multi-year horizon under a baseline and an adverse scenario. However, the ongoing obligation to maintain risk-bearing capacity and to conduct regular stress tests — including tests for material risks and risk interdependencies — applies exclusively to medium-sized firms.

Control Functions and Management Responsibility Mirror the MaRisk

The WpI MaRisk spells out senior management’s overall responsibility for risk culture, risk appetite, risk management, and the establishment of appropriate monitoring and control processes — mirroring the existing MaRisk framework. Senior management’s duty to report to the chair of the supervisory body on business performance, business and risk strategy, risk position, and serious findings from Internal Audit and Compliance follows the approach set out in the MaRisk revision of 30 June 2026.

Firms are expected to establish proportionate risk-controlling, compliance, and internal audit functions commensurate with the nature, scope, complexity, and risk profile of their business. The setup, rights, responsibilities, and duties of these functions follow the MaRisk requirements, adapted to each firm’s specific circumstances.

The WpI MaRisk also mirrors the MaRisk on material outsourcing. It expressly confirms that outsourced or third-party ICT services within the meaning of Article 3(21) DORA fall outside the scope of the WpI MaRisk.

Internal Control Expectations for Investment Firms

The WpI MaRisk sets out explicit expectations for firms’ internal control systems, covering trading controls, the integration of tied agents, risk management processes for material risks, and disorderly wind-down risk.

Small and medium firms must maintain organisational separation of trading, risk management, and settlement/control functions up to and including the senior management level — consistent with the MaRisk. The WpI MaRisk provides simplifications where a firm’s trading activities are low-volume and non-complex.

Firms that use tied agents must verify each agent’s professional competence and reliability and document the results. They must also develop strategies and procedures for the systematic oversight of their tied agents’ activities.

On liquidity risk management, the WpI MaRisk clarifies that firms engaged in proprietary trading or underwriting are generally expected to manage intraday liquidity risk.

Key implementation efforts arise from the suitability and reliability checks for tied agents and from the inclusion of disorderly wind-down risk.

Conclusion

With the WpI MaRisk of 24 August 2026, Bafin has given concrete shape to the proportionality principle for small and medium investment firms. Large investment firms are unaffected — they remain subject to the 9th MaRisk revision.

Small firms that previously had to meet full MaRisk requirements will see meaningful relief, particularly in the materiality assessment within the risk inventory, risk-bearing capacity, and stress testing. These simplifications must, however, be justified in light of the firm’s business model and risk profile.

Medium-sized firms may face additional implementation costs and ongoing expenses where they have not yet fully met MaRisk standards — especially regarding orderly wind-down assessment processes and the treatment of ESG risk drivers and ICT risks.

Key action items include:

• Gap analysis: Benchmark existing risk management documentation, policies, and process descriptions against the new WpI MaRisk modules.
• Risk governance and control functions: Review internal control systems, the independence of oversight functions, and the adequacy of outsourcing structures (including DORA interfaces).
• Risk-bearing capacity and stress testing: Adapt institution-specific risk-bearing capacity frameworks to investment services under the WpIG.

How We Can Help

As a specialist audit and advisory firm for financial services, we support you with tailored, resource-efficient implementation:

• Structured gap analyses and readiness checks to identify action items
• Overhaul and harmonisation of internal policies (organisation manual, risk strategies, ICS)
• Process and methodology implementation
• Outsourcing and governance reviews
• Preparation for and support during regulatory examinations and special audits

Contact our team — we are ready to help you integrate the new requirements into your operations early and with full regulatory confidence.