On 24 August 2026, the German Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht – BaFin) published Circular 09/2026 (WA), setting out the Minimum Requirements for the Risk Management of Investment Firms (WpI MaRisk).

For the first time, BaFin has adopted a targeted regulatory approach specifically designed for smaller and medium-sized investment firms, replacing the previous practice of applying the banking MaRisk. The circular establishes a dedicated supervisory framework for small and medium-sized investment firms under the German Investment Firm Act (Gesetz zur Beaufsichtigung von Wertpapierinstituten – WpIG).

The new requirements will enter into force on 1 January 2027.

Entities in Scope

The requirements of the WpI MaRisk apply to small investment firms (Kleine Wertpapierinstitute) within the meaning of Section 2(16) WpIG and medium-sized investment firms (Mittlere Wertpapierinstitute) within the meaning of Section 2(17) WpIG, including their foreign branches. Large investment firms (Große Wertpapierinstitute) within the meaning of Section 2(18) WpIG are expressly excluded from the scope of the circular. These firms remain subject to the supervisory framework under Section 4 WpIG, which applies the German Banking Act (Kreditwesengesetz – KWG) provisions, including Sections 25a and 25b KWG and the banking MaRisk (Circular 06/2026 (BA)).

Key Features of the new WpI MaRisk

The WpI MaRisk requires investment firms to implement a governance and risk management framework capable of identifying, assessing, managing and monitoring all material risks on an ongoing basis. A key element of this framework is the regular risk inventory, which must cover risks to clients, markets, the firm itself and liquidity risks, while also taking into account operational, ICT and ESG-related risks.

Particular emphasis is placed on management responsibility. Management bodies are expected to define the firm’s business and risk strategy, determine its risk appetite, promote an appropriate risk culture and maintain effective oversight of the firm’s risk profile. Appropriate governance arrangements, internal controls and oversight functions must be established to support these objectives.

The framework applies to both small and medium-sized investment firms but follows a clear proportionality principle. Whilst all firms are required to maintain appropriate governance and control arrangements, requirements relating to risk-bearing capacity and stress testing apply only to medium-sized investment firms. Smaller firms may adopt simplified approaches where justified by their size, business model and risk profile.

The circular further requires investment firms to maintain clear organisational policies addressing their organisational structure, allocation of responsibilities, risk management processes and the independence of control functions. Consistent with the principle of proportionality, smaller firms are afforded greater flexibility in the design of their governance arrangements. For example, the risk management function or the role of the compliance officer may be performed by a member of the management body, whilst internal audit responsibilities may, in certain circumstances, also be assigned to management.

The WpI MaRisk sets out a comprehensive outsourcing regime requiring investment firms to conduct risk assessments, monitor outsourced activities on an ongoing basis and maintain appropriate governance and control arrangements. Management responsibility remains non-delegable, and firms must retain sufficient internal expertise notwithstanding reliance on external service providers. Outsourced or externally procured ICT services falling within the scope of DORA (Regulation (EU) 2022/2554), in particular those subject to the ICT third-party risk management framework under Articles 28-30 DORA, are expressly carved out from the WpI MaRisk outsourcing requirements. The circular also reinforces the prohibition against investment firms becoming empty shells through excessive outsourcing, identifying indicators such as the firm’s seat being located outside Germany, numerous material outsourcing arrangements with third-country providers, and a disproportionately low number of employees relative to business scale.

The WpI MaRisk also sets out requirements for investment firms engaging tied agents (vertraglich gebundene Vermittler) under Section 3(2) WpIG. The engagement of each tied agent is treated as a separate outsourcing arrangement subject to the general outsourcing requirements of AT 9. Investment firms must assess both individual tied agent activities and the aggregate risk exposure arising from all liability assumptions, verify professional competence and reliability prior to onboarding, and establish strategies and procedures for systematic monitoring through sampling, computer-assisted controls or on-site inspections. The tied agent status is only established upon notification of the liability assumption to BaFin under the applicable regulation.

What should firms do now?

The WpI MaRisk introduces a dedicated risk management framework tailored to the business models of small and medium-sized investment firms.

Whilst the framework is generally principles-based and proportionate, firms should expect supervisory attention to focus increasingly on the quality of governance, the robustness of risk management processes and the ability of management to evidence that regulatory requirements have been implemented in a manner appropriate to the firm’s specific risk profile.

With the rules taking effect on 1 January 2027, investment firms should use the implementation period to reassess existing governance arrangements, risk inventories, outsourcing frameworks and reporting processes.

In particular, firms should expect increased supervisory scrutiny of their ability to evidence risk ownership, document proportionality decisions and maintain effective oversight over both internal functions and external service providers.