Circular 06/2026 (BA)Germany

MaRisk (Circular 06/2026)

MaRisk is Bafin’s circular specifying the risk management requirements of § 25a KWG. The 9th amendment, Circular 06/2026 (BA), in force since 30 June 2026, is more principles-based, removes ECB-supervised banks from its scope and grants defined relief to small and very small institutions.

Key points

01
Current version: Circular 06/2026 (BA) of 30 June 2026 (9th amendment), in force on publication, with a transition period until 1 January 2027 for additional requirements.
02
Banks classified as significant and directly supervised by the ECB are not addressees (AT 2.1); Bafin describes this as large ECB-supervised institutions leaving the MaRisk regime entirely.
03
Shorter and more principles-based (from 122 to around 80 pages, according to Bafin); Bafin states that the overall level of requirements has not been lowered.
04
Defined size classes: small institutions (SNCI under Article 4(1)(145) CRR and CRD third-country branches of risk class 2) and very small institutions (four-year average total assets not exceeding EUR 1 billion) receive explicit relief.
05
AT 4.3.4 sets requirements for the use of models, explicitly including automated models, technology-enabled innovation and artificial intelligence.
06
AT 5 requires organisational guidelines documented in text form (“in Textform”); the previous wording was “schriftlich fixiert”.

Status

The 9th MaRisk amendment, Circular 06/2026 (BA) of 30 June 2026, entered into force on publication. Where it creates additional requirements, a transition period until 1 January 2027 applies; the same date applies to organisational changes where institutions had documented a different reading of Bafin’s supervisory communication of 26 November 2024, which is now part of the text. The previous version was Circular 06/2024 (BA) of 29 May 2024 (8th amendment).

What it requires

01
Internal control system (AT 4.3, AT 4.3.1)
According to the nature, scale, complexity and riskiness of its activities, each institution sets rules on organisational structure and processes, establishes risk management and controlling processes, and implements a risk control function and a compliance function. Incompatible activities are performed by different employees, and processes, tasks, competences, responsibilities and communication channels are clearly defined and aligned.
02
Risk management and controlling processes (AT 4.3.2)
Appropriate processes to identify, assess, manage, monitor and communicate material risks, integrated into overall bank management. Risks and risk concentrations are effectively limited and monitored, taking into account risk-bearing capacity and risk appetite.
03
Use of models (AT 4.3.4)
Applies to models used in the processes governed by MaRisk, including automated models, technology-enabled innovation and artificial intelligence; models within the scope of the CRR are excluded. Institutions justify assumptions, assess suitability before use and regularly, ensure data quality, regulate the use of results including overrides, validate regularly and ensure sufficient explainability.
04
Organisational guidelines (AT 5)
Business is conducted on the basis of organisational guidelines, such as manuals, work instructions or process descriptions, that are suitable as an audit basis for internal audit, documented in text form, made known to staff and adjusted promptly. They contain in particular organisation and competence rules including the overview under § 25c(4a) no. 8 KWG, risk processes, internal audit, legal compliance, outsourcing procedures and, depending on size, a code of conduct.
05
Special functions (AT 4.4)
Every institution has a risk control function (AT 4.4.1), a compliance function that as a rule reports directly to management (AT 4.4.2) and an internal audit function with complete and unrestricted information rights that reports directly to management (AT 4.4.3).
06
Documentation (AT 6)
Business, control and monitoring records are drawn up so that knowledgeable third parties can follow them and are retained for five years. Material actions and determinations for compliance with the circular are documented, including when management must be involved.

What it means for the board and executive management

01
All members of management are responsible for proper business organisation and its development, regardless of internal allocation of responsibilities, including developing and monitoring an appropriate risk culture (AT 3.1).
02
Management informs the supervisory body at least quarterly in text form on the business and risk situation, with an assessment (AT 3.2).
03
More principles mean more discretion: Bafin expects the material determinations to be documented, including the cases that require a management decision (AT 6).
04
The choice of models is the institution’s responsibility (AT 4.3.4); for models with artificial intelligence characteristics, explainability must be ensured.

In MRM-Solution

How MRM-Solution supports it

01Generate policies from the modelled processes, so roles and responsibilities in the text match how the work is actually done.
02Attach controls to the activities they secure, record tests or import results in your own spreadsheet layout, and track deficiencies to closure.
03Model committees, mandates and escalation lines once; the structure is checked for gaps, cycles and independence of the second line.
04Keep an append-only audit trail of who changed what, when and in which role, plus a change log per policy.

Book a demo

Questions executives ask

Which MaRisk version applies today, and by when must we comply?

Circular 06/2026 (BA) of 30 June 2026, the 9th amendment, which entered into force on publication. Where it creates additional requirements, Bafin grants a transition period until 1 January 2027. The previous version was Circular 06/2024 (BA) of 29 May 2024.

Does MaRisk cover models and artificial intelligence?

Yes. AT 4.3.4 applies to models used in the processes governed by MaRisk, including automated models, technology-enabled innovation and artificial intelligence, whether developed in-house or by a third party; CRR models are excluded. It requires justified assumptions, data quality, rules for overrides, regular validation and sufficient explainability, scaled to the model’s complexity and importance.

Does MaRisk apply to a Swiss bank’s branch in Germany?

AT 2.1 names institutions under § 53(1) KWG and CRD third-country branches under § 53c KWG, the latter in accordance with §§ 53c to 53cq KWG, and excludes only branches of EEA undertakings under § 53b KWG. As a CRD third-country branch has no supervisory body, it involves its head office in an appropriate form instead; branches of risk class 2 count as small institutions.

Sources

Executive summary for orientation, not legal advice. The official text prevails.

Reference: Circular 06/2026 (BA)
Official title: Circular 06/2026 (BA) – Minimum Requirements for Risk Management (MaRisk)
Issued by: Federal Financial Supervisory Authority (Bafin), Germany
Type: Circular
In force since: 30 June 2026
Applies to: Institutions under § 1(1b) and § 53(1) of the German Banking Act (KWG) that are not significant institutions directly supervised by the ECB, as well as CRD third-country branches under § 53c KWG and foreign branches of German institutions; not branches of EEA undertakings under § 53b KWG (AT 2.1).
Last reviewed: 13 October 2026