9th MaRisk Amendment 2026 – Supervisory Briefing: Focus following the consolidation phase

On 19 June 2026, BaFin announced the final content of the 9th MaRisk Amendment in the digital supervisory briefing. The two main objectives were confirmed: reducing complexity and strengthening proportionality. Thanks to the reorientation and significantly streamlined wording of MaRisk, institutions will have greater discretion in future. Furthermore, institutions will be required to take on more personal responsibility.

9th MaRisk Amendment: the key changes in brief

As was already evident in the consultation draft, the 9th MaRisk Amendment represents one of the most significant changes in recent years. The key changes can be summarised as follows:

• Institution classification and opening clauses: Removal of Significant Institutions (SIs) from the scope of MaRisk; greater differentiation of Less Significant Institutions (LSIs) into very small, small and other LSIs
• Risk inventory and risk-bearing capacity: Establishment of the 5% materiality threshold as the upper limit for the total of immaterial risks and the option to extend the validation cycle to up to three years
• Stress tests: Relief for small institutions through a reduction in scope and complexity
• Risk reporting: Greater flexibility in reporting
• ESG risks: Clarification of requirements, focus on environmental and climate risks, scenario analysis required
• Special functions: Removal of the mandatory requirement for an outsourcing officer and the option for small institutions to outsource outsourcing management; further opportunities for simplification
• Lending business: Principle-based design of the regulations, with potential for simplification of collateral valuation processes
• Integration of European requirements: Implementation of CRD VI (where not already covered by the German Banking Act (KWG)) and EBA Guidelines

Detailed information on the changes can be found here.

Supervisory briefing – key questions from the institutions’ perspective

In addition to the presentation of the final version of the 9th MaRisk Amendment, numerous questions were answered during the digital supervisory briefing on 19 June 2027. Alongside organisational questions, participants raised queries particularly on the following topics:

1. Outsourcing and the outsourcing officer,
2. proportionality and size categories, and
3. the ‘SIs/ECB’ scope of application.

There were no substantive changes to the content of the latter two topics compared with the consultation draft. For context, we therefore refer you to the overview article MaRisk 2026 – Outlook on the reorientation.

On the topic of ‘Outsourcing & Outsourcing Officers’, the following clarifications were provided:

A central outsourcing officer is no longer mandatory. Instead, outsourced services may in future also be monitored on a decentralised basis within the specialist departments, provided that the separation of internal control functions from operational activities is maintained. Furthermore, all functions relating to the appointment of representatives may be performed by a single person – there are no longer any stipulations in MaRisk regarding the number of representatives.

In addition, small institutions may fully outsource their outsourcing management, for example to a central group function. Detailed information on the changes can be found here.

Further insights from the supervisory briefing

In addition to the adjustments already communicated previously, the supervisory authority provided further clarification on the following topics:

• Discretionary clauses: It was clarified that the use of discretionary clauses by institutions does not require a detailed written justification. However, senior management must be able to provide sound justification for their use.
• Paradigm shift in supervision: There is no fundamental change to the requirements for supervisory reviews; however, reviews will be structured in a more risk-oriented manner and tailored more specifically to the individual institution.
• Internal audit: Project-related advisory activities remain permissible; it is important that the independence of the internal audit function is maintained.
• Validation and adequacy assessment in the context of risk-bearing capacity: Institutions are not required to provide a comprehensive written justification when extending the validation frequency. Nevertheless, they should be able to provide a sound justification for the appropriateness of the chosen validation cycle (in future up to 3 years). For example, extending the timeframe appears appropriate only for those models in which no major anomalies have regularly come to light in previous years. Furthermore, the wording is expanded to include ‘validation and adequacy assessment’, meaning that the frequency of adequacy assessments for models and parameters may also be extended. Furthermore, the institution-specific adequacy assessment may also be carried out by central service providers. The risk inventory, on the other hand, must continue to be carried out annually.
• ESG risks: The requirements set out in the 7th amendment to MaRisk remain unchanged in substance. The focus remains on environmental risks, particularly climate risks. The supervisory authority expects institutions to make further progress in this area, with quality taking precedence over quantity. An annual review of the impact of ESG risk factors on traditional risk drivers is required as part of the risk inventory. In future, the choice of methodology will rest more heavily with the institution itself, although the approach selected must be appropriate to its own business model. For small institutions, qualitative methods are sufficient for long-term analysis. Scenario analyses for climate risks are required in all cases.
• Special functions: Internal audit and compliance functions may be fully outsourced for very small institutions. This also applies to immaterial subsidiaries of small institutions.
• Audit of multi-client service providers: The supervisory authority will maintain its practice of conducting detailed and quantitative audits of models used by multi-client service providers, as the cumulative impact of model errors, when multiplied across a large number of institutions, is significant overall.

Outlook and validity

The final version of the 9th MaRisk Amendment was published on 30 June 2026. A transitional period for the new provisions applies until 1 January 2027, meaning that the changes will not form part of the 2026 annual audit.