BaFin significantly revised its previously published draft WpI-MaRisk on risk management requirements for German investment firms, with a particular emphasis on the principle of proportionality.

By Axel Schiemann and Lasse Winzer

Link to Key Points: Key Points:

  • BaFin’s draft changes to the WpI-MaRisk shift towards a more principles-based and proportionate framework tailored to the risk profile of small- and medium-sized investment firms.
  • The Revised Draft simplifies, among others, requirements around control functions, internal audit, and reporting obligations to reduce internal bureaucracy.
  • The consultation runs until 17 June 2026, with the new rules scheduled to take effect from 1 January 2027.

On 8 May 2026, BaFin published a revised draft of its Circular 05/2026 on the Minimum Requirements for Risk Management at Investment Firms (WpI-MaRisk) for consultation (the Revised Draft).

The WpI-MaRisk provides guidance on the risk management requirements set out in the German Investment Firms Act (Wertpapierinstitutsgesetz – WpIG), MiFID II1 and Commission Delegated Regulation (EU) 2017/565. The WpI-MaRisk is based on the MaRisk,2 which encompasses the relevant risk management guidance from the EBA Guidelines on internal governance3 as well as the joint EBA and ESMA Guidelines on the assessment of the suitability of members of the management body and key function holders.4 While the currently applicable MaRisk addresses credit institutions and financial services institutions under the German Banking Act (Kreditwesengesetz – KWG), the WpI-MaRisk aims to address the specific characteristics of small- and medium-sized investment firms.

BaFin published the initial WpI-MaRisk draft on 6 August 2025 for public consultation (the Initial Draft). According to a comparison conducted by the Bundesverband der Wertpapierfirmen e.V., more than two-thirds of the text was identical to the MaRisk. Based on the comments received as part of the public consultation, BaFin comprehensively revised and significantly shortened the Initial Draft to emphasise principles-based requirements specifically tailored for investment firms. Per BaFin, the WpI-MaRisk places greater emphasis on the principle of proportionality and the applicable risk profile.

Link to Notable Differences Between the MaRisk and WpI-MaRisk Notable Differences Between the MaRisk and WpI-MaRisk

  • Control functions. In contrast to the requirements of the MaRisk, the WpI-MaRisk does not prohibit assigning the compliance officer role to a member of the management board of very small firms (sehr kleine Institute). Likewise, establishing internal audit and risk management functions is subject to the requirements of adequacy and proportionality. The internal audit function may be omitted in certain cases, if it would be disproportionate for a member of the management board to perform the internal audit function as long as avoid conflicts of interest can be avoided.
  • Risk reporting obligations. Under the WpI-MaRisk, internal reporting is required in reasonable intervals and when required, rather than quarterly as specified under the MaRisk. This is intended to provide more flexibility for small- and medium-sized investment firms by reducing internal bureaucracy.
  • Supervisory body. Internal reporting to the supervisory body (Aufsichtsorgan) is simplified. In contrast to the MaRisk, the WpI-MaRisk does not require written quarterly reporting.

The consultation period is open for comments until 17 June 2026. The WpI-MaRisk is scheduled to take effect from 1 January 2027.

Latham & Watkins will continue to monitor and report on developments related to the WpI-MaRisk.