Policy attestation

Internal rules only bind people who know them. MaRisk requires organisational rules to be made known to the staff concerned in a suitable way and to be available to them in their current version. Attestation is the common way to evidence this: a defined target group confirms, within a deadline, that it has read and understood a new or materially changed policy.

For the board and the executive board, completion rates show whether the rules set at the top reach the organisation. Attestation records also matter in internal investigations and disciplinary cases, where the bank must show that an employee knew the rule that was breached.

Pitfalls are attestations reduced to a single click without any check that the document was opened, campaigns sent to everyone instead of the people actually affected, no new attestation after material changes, and overdue confirmations that are never escalated.

In practice

1. 01
   Defines the target group of each policy by role, unit and jurisdiction.
2. 02
   Requires a new attestation after material changes, but not after editorial ones.
3. 03
   Accepts the confirmation only after the document has been opened, and for critical policies only after it has been read in full.
4. 04
   Tracks completion per campaign and escalates overdue confirmations to line managers.
5. 05
   Stores each attestation together with the policy version it refers to.

Sources

• BaFin Circular 06/2026 (BA), Mindestanforderungen an das Risikomanagement (MaRisk), 30 June 2026 →