Ninth MaRisk amendment: changes and implementation

The 9th MaRisk amendment is the new version of the German Minimum Requirements for Risk Management published by BaFin on 30 June 2026 as Circular 06/2026 (BA), more principles-oriented and with more proportionality (BaFin announcement of 30 June 2026). It entered into force upon publication; a transition period until 1 January 2027 applies only where additional requirements arise in individual cases (cover letter of 30 June 2026, ref. BA 54-FR 2210/00067#00005). The amendment emerged from consultation 02/2026 (draft of 1 April 2026, BaFin announcement of 1 April 2026). This article covers the change delta in detail; the framework, structure (AT/BT) and amendment history of the MaRisk as a whole are covered by the reference article MaRisk: current version, Circular 06/2026, AT/BT structure and amendments.

What does the 9th MaRisk amendment change?

The 9th MaRisk amendment (Circular 06/2026 (BA), 82 pages) streamlines the MaRisk at the interfaces with DORA, restructures the Special Part (BT), introduces AT 3.2 as a dedicated module on the responsibility of the supervisory body and scales the requirements by size category. According to BaFin, the level of requirements remains unchanged. The cover letter to Circular 06/2026 (BA) of 30 June 2026 states verbatim:

The delta table shows the key changes of the 9th MaRisk amendment versus the 8th amendment (Circular 06/2024), each with its reference:

When did the 9th MaRisk amendment enter into force and by when must it be implemented?

The 9th MaRisk amendment entered into force on 30 June 2026 with the publication of Circular 06/2026 (BA); BaFin grants a transition period until 1 January 2027 only where additional requirements arise in individual cases (cover letter of 30 June 2026, ref. BA 54-FR 2210/00067#00005). The cover letter states verbatim:

The deadline therefore does not apply across the board; beyond that, it only covers adjustments where an institution has documented a deviating interpretation of the supervisory notice of 26 November 2024, which has been incorporated into the MaRisk. A full calendar of implementation deadlines is provided by the banking regulation roadmap.

What was in consultation 02/2026 and what changed in the final version?

BaFin published the draft of the 9th MaRisk amendment on 1 April 2026 as consultation 02/2026 (comments until 8 May 2026); the final version of 30 June 2026 adopts the main lines of the draft but deviates in verifiable respects. New is AT 4.2 para. 5: small institutions may monitor strategy and capital planning only annually “if, in addition to the supervisory capital requirements and recommendations, they hold a further buffer of at least two percentage points of Common Equity Tier 1 capital" (Circular 06/2026, unofficial translation).

Compared with the consultation draft 02/2026, the final version of the 9th MaRisk amendment also deleted the standalone duty of internal audit to accompany projects (draft AT 4.4.3 para. 5); in the final version, only the right to information and access remains, “including when accompanying material projects” (AT 4.4.3 para. 1, unofficial translation). The final version names the outsourcing register expressly in AT 9 para. 12 b); the draft contained the duty without the term. The explanatory note to AT 9 para. 10 still refers to an overall report to be prepared by the audit officer under AT 4.4.3 para. 11, and to a review of remediation in accordance with AT 4.4.3 para. 13; this reference already appears word for word in the explanatory note of the consultation draft and matches neither its numbering nor the final version: the final AT 4.4.3 has only 12 paragraphs and knows no overall report. Until BaFin corrects this editorial error, the passage cannot serve as evidence of an overall reporting duty.

The revised MaRisk refer to the European requirements identified in the circular. Later changes need assessment for their effect on the institution’s processes. A consultation date is not the application date of a final rule. BaFin: Rundschreiben 06/2026 (BA), MaRisk

What relief applies to small and very small institutions?

The 9th MaRisk amendment defines the size categories in AT 1 para. 3 (Circular 06/2026): small institutions are institutions classified as SNCIs (Art. 4 (1) No. 145 CRR) as well as CRD third-country branches of risk class 2; very small institutions have total assets of no more than EUR 1 billion on a four-year average and can use the relief even without an SNCI classification. SIs within the meaning of Art. 6 SSM Regulation are removed from the scope (AT 2.1 para. 1); all other LSIs remain the regular addressees.

Specific relief (each per Circular 06/2026): at very small institutions, a member of the management board may perform the compliance officer function (AT 4.4.2 para. 4) and tasks of internal audit (AT 4.4.3 para. 1), in each case with safeguards against conflicts of interest; the complete outsourcing of both functions is possible (AT 9 para. 5). A member of the management board of a very small institution may also take on the tasks of the audit officer where an appointment below management board level would be disproportionate (AT 9 para. 10). Very small institutions may dispense with risk-type-specific stress tests (AT 4.3.3 para. 2); for small institutions, an institution-wide downturn scenario generally suffices, and inverse stress tests are dispensable (AT 4.3.3 paras. 3–4). Small institutions need to review the risk analysis of their outsourcing arrangements only every three years (AT 9 para. 2). Annual strategy monitoring is conditional on the capital buffer under AT 4.2 para. 5.

LSI checklist: changes to review by 1 January 2027

The checklist bundles the review points of the 9th MaRisk amendment for an LSI; the transition period until 1 January 2027 applies only where additional requirements arise in individual cases. Everything else has applied since 30 June 2026 (cover letter):

1. 01Scope of application

   Document the classification as an SNCI, a very small institution (total assets ≤ EUR 1 billion on a four-year average) or another LSI (AT 1 para. 3; AT 2.1 para. 1).

2. 02AT 9/DORA dividing line

   Assign ICT services under Article 3(21) DORA that are subject to third-party risk management under Articles 28–30 DORA to the DORA register of information. Only these services fall within the AT 9 exception. Separately assess whether they also constitute outsourcing under section 25b KWG and whether the associated register duties apply.

3. 03Central outsourcing management

   Set up the role in place of the outsourcing officer; maintain the outsourcing register under Section 25b (1) sentence 4 KWG (AT 9 para. 12 b).

4. 04Internal audit setup

   Reflect the removal of BT 2; quarterly reports instead of an annual overall report (AT 4.4.3 para. 9).

5. 05Supervisory body reporting

   Define the procedure under AT 3.2; information at least quarterly in text form, with delegation to a committee by resolution where applicable (AT 3.2 para. 2).

6. 06ESG/stress tests

   Integrate environmental risks into stress tests, add resilience analyses (AT 4.3.3 para. 7); review the ESG anchoring via Section 26c KWG (AT 1 para. 1).

7. 07Decide on relief

   Combination of offices, tiered stress testing, three-year cycle for the outsourcing risk analysis (AT 9 para. 2), annual strategy monitoring (only with a buffer of at least 2 percentage points of Common Equity Tier 1 capital, AT 4.2 para. 5); justify and document every instance of relief used.

8. 08Supervisory notice of 26 November 2024

   Where a deviating interpretation has been documented, plan adjustments by 1 January 2027 (cover letter).

What changes for outsourcing (AT 9) and ICT/DORA?

The ninth MaRisk amendment removes certain DORA ICT services from the scope of AT 9. Whether statutory outsourcing duties under section 25b KWG also apply requires a separate assessment. The explanatory note on AT 9 paragraph 1 states:

Flanking this, AT 7.2 has been reduced to 2 paragraphs because ICT risk management runs via the DORA regulation; the BAIT will be repealed as of 31 December 2026 (BaFin announcement of 9 January 2025). Business continuity management under AT 7.3 also follows the DORA alignment: AT 7.3 para. 1 now uses the DORA terminology “critical or important functions” and requires management to be informed in writing about the state of business continuity management at least quarterly and on an ad hoc basis (Circular 06/2026).

For ICT third-party providers that are legal persons established in the EU, the register permits an LEI or EUID. Equivalent providers outside the EU must use an LEI. Separate template rules govern identifiers for natural persons acting in a business capacity. The European Supervisory Authorities reported 3,383 major ICT-related incidents under DORA for 2025. Around one third involved third-party providers. These figures come from their first annual report, published on 3 June 2026. Implementing Regulation (EU) 2024/2956, register templates Corrigendum to Implementing Regulation (EU) 2024/2956 ESAs: first DORA report on major ICT-related incidents

Within AT 9, the 9th MaRisk amendment replaces the outsourcing officer with central outsourcing management, which documents outsourcing arrangements including sub-outsourcing in accordance with Section 25b (1) sentence 4 KWG; the outsourcing register is expressly named in the regulatory text (AT 9 para. 12 b, Circular 06/2026). The report on material outsourcing goes to the management board (para. 13); at very small institutions, a board meeting suffices.

Does the 9th MaRisk amendment also apply to AI models?

Yes: module AT 4.3.4 “Use of models” of the MaRisk (Circular 06/2026 (BA) of 30 June 2026) expressly extends its requirements to artificial intelligence in para. 1:

The amendment to the AI Act under Regulation (EU) 2026/1744 has been in force since 27 July 2026. The relevant obligations for Annex III high-risk systems apply from 2 December 2027; those for Annex I high-risk systems apply from 2 August 2028. Regulation (EU) 2026/1744 amending the AI Act European Commission: AI Omnibus enters into force

What changes for stress tests, ESG and reporting?

For stress tests, the 9th MaRisk amendment requires environmental risks to be taken into account and supplemented by long-term resilience analyses (AT 4.3.3 para. 7, Circular 06/2026); AT 1 para. 1 now also specifies Section 26c KWG (ESG risks), implementing, among others, EBA/GL/2025/01 and EBA/GL/2025/04 (AT 1 para. 2). The tiering of stress tests by size category is governed by AT 4.3.3: very small institutions may dispense with risk-type-specific stress tests (para. 2), for small institutions an institution-wide downturn scenario generally suffices, and inverse stress tests are dispensable for small institutions (paras. 3–4).

In reporting, the 9th MaRisk amendment restructures the Special Part: BT 2 “Internal audit” is dropped (consolidated into AT 4.4.3), and risk reporting moves from BT 3 to BT 2 (Circular 06/2026). The annual overall report of internal audit is dropped; quarterly reports remain (AT 4.4.3 para. 9). Newly regulated is the involvement of the supervisory body: under AT 3.2 para. 2, management must inform the supervisory body at least quarterly in text form about the business and risk situation; forwarding can be limited to a committee by resolution. The former AT 4.3.4 (risk data aggregation) has been dropped without replacement; “Use of models” now carries the number AT 4.3.4.

Where is the comparison version (redline 8th ↔ 9th amendment) available?

BaFin provides the official comparison versions on the download page for Circular 06/2026 (BA): the comparison 8th ↔ 9th amendment as well as the comparison consultation draft ↔ final version, each alongside the circular and the cover letter. Deutsche Bundesbank lists the new version as the “MaRisk-Neufassung 2026” (MaRisk new version 2026). The delta table above provides the entry point; for paragraph-level precision, only the official redline documents are authoritative.

Related topics

• MaRisk: current version, Circular 06/2026, AT/BT structure and amendments: framework, Section 25a KWG, amendment tracker.
• DORA regulation: the ICT regime since 17 January 2025: where ICT risks and ICT third-party arrangements migrate to.
• DORA register of information: deadline, content, templates: obligation, ITS templates ((EU) 2024/2956), submission cycles.
• Banking regulation roadmap: all implementation deadlines 2026 to 2028+.

Frequently asked questions about the 9th MaRisk amendment

An offer from T-NEX GmbH

Discuss the project with T-NEX

Regulatory changes need to become requirements, accountabilities and implementation projects. T-NEX Compliance supports the business workflow; PPM helps structure projects and dependencies.