Reading version of the newly published Minimum Requirements for Risk Management of Investment Firms (WpI-MarRisk)

Five years after the German Investment Firms Act (Wertpapierinstitutsgesetz—WpIG) came into force, Bafin has thus established a separate framework of supervisory expectations for risk management, tailored to the specific characteristics of small and medium-sized investment firms.

Until now, investment firms had to apply the Minimum Requirements for Risk Management applicable to credit institutions (MaRisk) mutatis mutandis. This presented difficulties not only in view of the differing business activities, but also with regard to the “appropriate” extent to which the requirements needed to be applied in individual cases.

Bafin had already submitted a draft of the WpI-MaRisk for consultation in August 2025 but then set it aside for revision. A second consultation draft followed in May 2026, which was also aligned with the MaRisk for credit institutions, which had likewise been updated as part of the 9th Amendment.

With only very minor changes to this second consultation draft, the final version of the WpI-MaRisk has now been published. It will come into force on January 1, 2027 and sets out in detail the requirements of Sections 13, 20, 28, Chapter 5, Section 1 of the German Investment Firms Act (Wertpapierinstitutsgesetz—WpIG), Sections 80 and 81 of the German Securities Trading Act (Wertpapierhandelsgesetz—WpHG) and Delegated Regulation (EU) 2017/565. 

The WpI-MaRisk apply to small and medium-sized investment firms—large investment firms must continue to apply the MaRisk. According to Bafin, small and medium-sized investment firms may continue to apply the MaRisk in the version set out in the 8th Amendment during the transitional period—these investment firms are therefore not required to implement the requirements of the 9th Amendment to the MaRisk, which were published at the end of June.  

Next steps

We recommend that investment firms carry out a gap analysis at an early stage between their existing practices and the requirements of the WpI-MaRisk in order to avoid subsequent compliance costs and implementation difficulties. This serves not only to identify new obligations, but also to make use of the new room for manoeuvre opened up by the WpI-MaRisk.

Investment firms should critically scrutinise their established structures and examine where simplifications can be made in the interests of proportionality, and where risk management can be aligned more closely with their own business model.

To provide you with a clearer overview of the changes to the framework, we have compiled a reference document which compares the MaRisk as set out in the 8th Amendment (i.e., the version that, according to Bafin, may be applied until the WpI-MaRisk comes into force) with the new WpI-MaRisk. Download the reference document below.