New KaMaRisk: What Changes for Capital Management Companies

The first amendment to the German Minimum Requirements for Risk Management of Capital Management Companies (Kapitalverwaltungsgesellschaften, KaMaRisk), introduced in 2017, is set to be replaced by a new version in the near future. The 2026 revision of KaMaRisk has been driven in particular by the German Fund Risk Limitation Act (Fondsrisikobegrenzungsgesetz, FRiG), which implements the requirements of the EU’s Alternative Investment Fund Managers Directive II (AIFMD II) into German law.

With the consultation draft of the new KaMaRisk published on 12 June 2026, the supervisory authority has sent a strong signal in favor of greater practicality for capital management companies by, among other things, eliminating the requirements for functional separation and formal voting procedures. The consultation period for the revised KaMaRisk framework expired on 1 July 2026.

In addition, the new consultation draft removes overlaps with Regulation (EU) 2022/2554 (DORA), explicitly incorporates ESG risks, and aligns internal audit requirements with international standards.

Leaner Structures Through the Elimination of the Back-Office Function

The new KaMaRisk takes a long-overdue step by removing the requirements for functional separation and voting procedures between front-office and back-office functions in lending-related decision-making processes. Instead, organizational requirements are now focused on just two key organizational units, which must continue to remain strictly separated within capital management companies:

• Market or Fund Management Unit, where investment and lending decisions are made.
• Risk Controlling Function Unit, which independently oversees the risk management process, including the monitoring of investment fund risk profiles and other aspects of risk management.

For decisions relating to, among other things, lending from fund assets, these two functions will be the primary responsible units going forward. The previously required back-office function will no longer be mandatory and may instead be maintained on a voluntary basis.

As a result, capital management companies can reduce administrative effort and implement simpler and more efficient decision-making processes, particularly in connection with lending activities.

Greater Organizational Flexibility in Fund Lending Activities

Another notable change in the new KaMaRisk, already foreshadowed by the ninth MaRisk amendment, is the supervisory shift away from prescriptive organizational requirements toward a focus on the actual risk profile of each capital management company. This places greater emphasis on the substantive quality of lending processes within AIF management companies while allowing for more flexibility in organizational design.

The previous formal functional separation requirements will give way to a stronger focus on the already existing obligations relating to the assessment, monitoring, and early identification of credit risks.

Going forward, the decisive question will be less about which specific organizational unit must participate in a credit decision and more about whether the capital management company maintains an appropriate strategy and effective procedures for identifying, assessing, managing, and monitoring credit risks.

Credit risks must continue to be analyzed on a risk-oriented basis according to their key drivers, including country risks and concentration risks, and should be assessed through additional scenarios where appropriate.

This will allow capital management companies to align their processes more closely with their actual risk profiles rather than replicating rigid organizational structures.

Greater Clarity Through the Removal of DORA Overlaps

The new KaMaRisk consistently eliminates duplicate requirements that already exist under DORA. Requirements such as the separation of production and test environments for IT systems will no longer be regulated under KaMaRisk but exclusively under DORA. This creates greater clarity regarding supervisory expectations, reduces audit and administrative burdens, and improves the consistency of regulatory requirements.

Integration of ESG Risk Drivers into Risk Identification

The management of ESG risks is explicitly incorporated into the consultation draft of the new KaMaRisk. However, ESG risks are not intended to be viewed in isolation. Instead, their impact on key risk categories must be assessed, including Credit risk, Market risk, Liquidity risk and Operational risk. In addition, the effects of ESG risks must be reflected in the institution’s risk-bearing capacity framework, risk management and controlling processes, as well as its organizational and operational structures.

For some capital management companies, this may require additional effort in risk identification processes and the integration of ESG considerations into risk-bearing capacity concepts.

Stricter Requirements for Internal Audit Resource Planning

The requirements applicable to internal audit functions have been brought closer into line with international standards. Under the new framework, employees may no longer audit activities for which they have been responsible within the preceding twelve months. This may have implications for workforce planning in organizations where employees regularly rotate between operational functions and internal audit.

Conclusion

The consultation draft of the new KaMaRisk provides capital management companies with greater organizational flexibility by eliminating requirements such as functional separation and formal voting procedures. At the same time, regulatory expectations regarding independent risk management and the identification and assessment of ESG risk drivers have been maintained or further strengthened.

Overall, implementation of the new KaMaRisk is unlikely to result in a significant increase in compliance costs for many capital management companies. At the same time, the removal of mandatory front-office/back-office separation requirements could enable more streamlined and efficient decision-making processes.

Publication of the final circular is expected in the autumn or winter of this year.

As experienced advisors and auditors, we support capital management companies in interpreting the new KaMaRisk requirements, conducting impact assessments, and implementing pragmatic and effective processes and methodologies in line with the revised regulatory framework. Our approach focuses not only on achieving regulatory compliance but also on ensuring that processes remain practical, efficient, and effective.