Dedicated Minimum Requirements for Investment Firms
For a hike in the Taunus or Vogelsberg, equipment tailored to the route, terrain and the individual’s physical capabilities is sufficient. By contrast, an expedition backpack for climbing Mont Blanc or Mount Everest would make the hike more difficult without any objective reason. Dr. Thorsten Pötzsch, Chief Executive Director of Securities Supervision and Asset Management at the Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin, German Federal Financial Supervisory Authority), used this comparison at the 3rd Conference on the Regulation of Investment Firms on 26 October 2026 to describe the supervisory practice previously applied to small and medium-sized investment firms.
For years, these firms were required to apply, mutatis mutandis, the Mindestanforderungen an das Risikomanagement (MaRisk, Minimum Requirements for Risk Management) developed for credit institutions. Although the banking MaRisk contained opening clauses and had to be applied proportionately, key questions remained unresolved. In particular, it was not consistently clear which banking supervisory requirements were relevant, how they had to be adapted to the business models of investment firms and how far exemptions could extend.
With the Mindestanforderungen an das Risikomanagement von Wertpapierinstituten (WpI MaRisk, Minimum Requirements for Risk Management for Investment Firms), this sector is now receiving its own regulatory framework. The rules expressly apply from 1 January 2027 and supplement the Wertpapierinstitutsgesetz (WpIG, German Investment Firm Act), which entered into force in 2021.
Scope and Regulatory Basis
The WpI MaRisk were published as Rundschreiben 09/2026 (WA) (Circular 09/2026 (WA)) by BaFin’s Securities Supervision Directorate, Division WA 41, dated 24 August 2026. The circular comprises 35 pages and is addressed to small and medium-sized investment firms. Large investment firms will continue to be subject to Rundschreiben 06/2026 (BA) (Circular 06/2026 (BA)) on the MaRisk for credit institutions.
Until the WpI MaRisk enter into force, the banking MaRisk will continue to apply to small and medium-sized investment firms. According to information provided by BaFin, the amendments introduced by the ninth MaRisk revision may be taken into account during this transitional period.
The new requirements provide further detail on §§ 38 ff. WpIG (German Investment Firm Act). In particular, they take account of Directive 2014/65/EU, MiFID II, in conjunction with Commission Delegated Regulation (EU) 2017/565, as well as other national and European requirements. The requirements also cover activities that do not require authorisation insofar as they affect the risks of the firm concerned.
Development of the Final Version
The first consultation began on 6 August 2025. Comments could be submitted until 19 September 2025. In its comments dated 19 September 2025, the Bundesverband der Wertpapierfirmen (Federal Association of Investment Firms) expressed profound scepticism about the initial draft as a whole and called for a fundamental revision in favour of a principles-based approach.
In May 2026, BaFin initiated a second consultation process. The provisions were also discussed by the Arbeitskreis Wertpapierinstitute und -firmen (Working Group on Investment Firms). According to its accompanying letter, BaFin made only a small number of further changes compared with the second consultation draft.
The final version was published on 24 August 2026. The requirements were also specifically aligned with the findings of the review of the KWG-MaRisk, i.e. the MaRisk under the Kreditwesengesetz (KWG, German Banking Act), in order to ensure consistency between the different sets of rules.
Why the Banking MaRisk Were Not a Sufficiently Good Fit
The banking MaRisk were designed for the business models, organisational structures and risk profiles of credit institutions. Investment firms, by contrast, are in some cases exposed to different risks and frequently have different structures. Applying the requirements mutatis mutandis therefore gave rise to questions of interpretation and demarcation in several areas.
Five Key Problem Areas
According to BaFin, the difficulties concerned the following areas in particular:
- The risk framework typically used by banks could not readily be applied to investment firms. In some cases, the relevant protective objective could be adopted, while the specific implementation had to be structured differently.
- Methods such as risk inventories and risk-bearing capacity assessments are part of the standard toolkit of credit institutions. In the case of small and medium-sized investment firms, however, it was necessary to determine in each case the extent to which the substantive and methodological standards developed for banks should apply.
- Governance and control-function requirements could place a considerable burden on small investment firms in particular. This concerned, among other things, an independent risk management function, internal audit and the segregation of individual functions.
- There were difficulties in distinguishing between outsourcing and other third-party procurement. This distinction became even more important as a result of the requirements of the Digital Operational Resilience Act for the financial sector, DORA.
- It was also unclear to what extent detailed requirements relating to trading activities, liquidity and contingency planning should be applied to firms that conduct neither lending nor deposit-taking business.
Differing interpretations could lead to divergent expectations among firms, statutory auditors and the supervisory authorities. The WpI MaRisk are intended to reduce these uncertainties by establishing a dedicated and transparent framework.
Investment Firms’ Risk Profiles as the Starting Point
The WpI MaRisk do not merely adopt selected parts of the banking MaRisk in abridged form. Instead, their starting point is the Wertpapierinstitutsgesetz and the requirements applicable to investment firms under the IFD, IFR, MiFID II and other sets of rules.
The circular is based on firms’ business models and the risks arising from them. The focus is on the potential consequences for clients, the market and the firm itself. The guiding principle is prudential supervision aimed at protecting clients.
The key requirements for governance, risk management, control functions and outsourcing are consolidated into a single set of rules. Separate sections address, among other matters, outsourcing in AT 9, the organisation of trading activities in BTH and the integration of tied agents in BTV.
Some of the terminology has also been adjusted. For example, the WpI MaRisk use the term “liquid assets” instead of “liquidity buffer”, which is commonly used in banking supervision. Where terminology derived from banking supervision continues to be used, it must be interpreted in light of the requirements applicable to investment firms. This does not mean that the substantive and methodological expectations applicable to credit institutions are transferred unchanged to investment firms.
Proportionality at Multiple Levels
Uniform minimum requirements cannot adequately reflect the heterogeneous structure of the investment firm sector in every case. BaFin therefore places proportionality and reduced complexity at the heart of the framework. This approach also reflects its strategic objective of making financial supervision and administrative practice more proportionate by 2029.
Differences Between Small and Medium-Sized Firms
The rules first distinguish between small and medium-sized investment firms. Certain requirements apply exclusively to medium-sized firms. These include, in particular, the requirements relating to risk-bearing capacity, stress tests and consideration of the risk of a disorderly wind-down.
AT 4.1.1 on risk-bearing capacity applies only to medium-sized investment firms. This is without prejudice to BaFin’s power under § 39 Abs. 3 WpIG (section 39(3) of the German Investment Firm Act) to require a small investment firm to comply with § 39 Abs. 1 und 2 WpIG (section 39(1) and (2) of the German Investment Firm Act).
Other obligations apply to both categories of firm but permit less onerous implementation by small investment firms. When assessing materiality as part of the risk inventory, for example, an informed qualitative estimate may suffice. The strategy process and the monitoring of target achievement may also be structured more simply.
Differentiation Within the Same Category of Firm
Classification as a small or medium-sized investment firm is not the only criterion. The nature, scale, complexity and risk profile of the relevant business activities are also decisive.
Stricter standards may apply to activities involving heightened risk. This includes, for example, dealing on own account or underwriting. The activities that entail heightened risk are defined separately for the individual regulatory areas.
Proportionality therefore does not lead exclusively to exemptions or simplified requirements. Where necessary to ensure appropriate and effective risk management, more extensive safeguards may be required that go beyond the wording of individual requirements. The proportionate approach thus constitutes risk-sensitive differentiation, not deregulation.
Indicative Presumptions Instead of Invariable Thresholds
Rigid thresholds are in some cases replaced by indicative presumptions. If the specified criteria are met, they establish a presumption for the standard case.
If a firm employs fewer than ten people, including members of senior management, BaFin generally assumes that a dedicated internal audit unit would be disproportionate. The same applies where internal audit tasks are performed by a member of senior management. However, this general presumption does not apply to certain high-risk business models.
A Principles-Based Approach Expands the Scope for Discretion
Alongside proportionality, the new framework is characterised by its principles-based approach. The WpI MaRisk focus more closely on the required outcome rather than prescribing every individual step for achieving it. This gives investment firms greater discretion when selecting their methods, procedures and organisational structures.
The supervisory authority’s primary task should not be to determine whether prescribed individual steps have formally been completed. Rather, the decisive factor is whether the structure chosen is appropriate and effective for the specific firm.
Methods Depend on the Nature and Materiality of the Risks
Medium-sized investment firms may generally determine their own methods and procedures for assessing risk-bearing capacity. Depending on the nature of a risk, quantitative or qualitative risk management tools may be used. Small investment firms may structure their strategy process in a less onerous manner.
In addition, numerous requirements depend on the materiality of the relevant risks. The specific requirements for risk management and control processes need only be applied insofar as the firm has classified the relevant type of risk as material in its risk inventory.
Compared with the first consultation draft and the previously applicable banking MaRisk, the rules have been streamlined. Highly detailed procedural requirements have therefore been scaled back in some areas. BaFin has not, however, dispensed entirely with specific minimum requirements.
Detailed Requirements in Particularly Relevant Areas
Detailed provisions remain in areas of particular importance. These specifically include outsourcing agreements, limits and internal audit. Under BaFin’s approach, specific requirements are necessary in these areas to ensure that certain risks are managed effectively and consistently.
A principles-based approach therefore means neither dispensing with binding standards nor allowing unrestricted discretion without evidentiary obligations. Firms must be able to demonstrate that their procedures and structures are appropriate for their business model and risk profile.
Changes to Audit and Supervisory Requirements
The more flexible approach does not concern investment firms alone. Statutory auditors must also conduct their audits on a risk-oriented basis. BaFin expressly expects them to examine whether all material risks have been identified, whether the governance arrangements are appropriate for the business model and whether the selected methods are transparent and comprehensible.
For its part, the supervisory authority must assess on a case-by-case basis whether risk management is actually effective. Greater freedom in implementation therefore entails greater responsibility for all parties involved. This applies both to those who design and implement risk management and to the audit and supervisory bodies.
Continuation of the Regime Change Initiated in 2021
With the WpI MaRisk, BaFin is continuing in its administrative practice the regime change initiated by the Wertpapierinstitutsgesetz. A framework is being created for small and medium-sized investment firms that is more closely aligned with their respective risks.
The proportionate structure is reflected in the distinction between categories of firm, the consideration given to the complexity and risk profile of business models, and the use of indicative presumptions and implementation flexibility. This is supplemented by the principles-based approach, under which the required outcome is given greater prominence than a uniformly prescribed method for achieving it.
The practical impact of this approach will become apparent after 1 January 2027. BaFin intends to exercise due judgement when assisting firms with its application and to develop assessment standards that are as consistent as possible. The decisive question will be whether the WpI MaRisk provide the basis for a consistent, risk-oriented supervisory practice that is appropriate to the particular characteristics of investment firms.
Significance for the German Investment Firm Sector
The WpI MaRisk apply to a large and diversely structured market. At the preceding conference on 3 November 2025, BaFin President Mark Branson stated that a total of 707 investment firms were under supervision. These included one large, 117 medium-sized and 589 small investment firms.
The 3rd Conference on the Regulation of Investment Firms in the Capital Markets Union was organised by the Hochschule der Deutschen Bundesbank (University of Applied Sciences of the Deutsche Bundesbank) together with the University of Basel. In addition to the WpI MaRisk, the conference focused on MiCAR crypto-asset services and ESG issues.
For the firms concerned, the new framework combines additional flexibility with increased requirements regarding justification, documentation and effectiveness. Companies, investors and high-net-worth individuals with questions about the classification and application of the WpI MaRisk or related capital markets law requirements can obtain legal advice on capital markets law from MTR Legal.
