9th MaRisk Amendment 2026: What Changes for Banks Now

Regulatory Compliance · Risk Management · BaFin

The 9th MaRisk Amendment is the revision of Germany’s Minimum Requirements for Risk Management published on 30 June 2026. The new MaRisk remains principles-based, reinforces the principle of proportionality, and, above all, reduces the burden on small and very small institutions. The transition period for new and stricter requirements runs through January 1, 2027; the relief measures are effective immediately.

Understood in 2 Minutes

- What’s new? Three mandatory size categories (very small, small/SNCI, other LSIs) with category-specific exemption clauses. The circular has been reduced from 122 to about 80 pages.
- Who benefits? According to BaFin’s assessment, the new size categories will ease the regulatory burden for 80 to 85 percent of institutions. Approximately 950 institutions (about three-quarters of German credit institutions) fall under the SNCI definition.
- Who is excluded? Significant institutions (SIs) under direct ECB supervision. Now included: Branches of third-country institutions pursuant to § 53c of the German Banking Act (KWG).
- When? Relief measures take effect immediately; new requirements apply as of January 1, 2027. The changes are therefore not subject to the 2026 annual financial statement audit.
- The catch: Exemption clauses are options, not automatic provisions. Any relief measure utilized requires a documented, risk-based justification, which will be subject to audit starting in 2027.

BaFin itself frames the revision as a "vote of confidence" ("Vertrauensvorschuss") in the institutions: fewer detailed prescriptions, more personal responsibility. By the supervisor’s own estimate, the vast majority of German credit institutions benefit from the new reliefs. This article covers the most important changes of the 9th amendment and a concrete implementation roadmap.

Timeline: from consultation to application

• 26 Nov 2024 — supervisory notice with the first SNCI reliefs (precursor)
• 1 Apr 2026 — BaFin publishes the draft for consultation (Consultation 02/2026)
• 19 Jun 2026 — digital supervisory briefing: final content presented
• 30 Jun 2026 — publication of the final 9th MaRisk Amendment
• 1 Jan 2027 — end of the transitional period for new and stricter requirements

Given the six-month timeframe for implementing new and stricter requirements, these changes will not yet be included in the 2026 annual financial statement audit.

The key changes at a glance

The 9th amendment is the most far-reaching revision of the MaRisk in years. The core points:

1. New scope: Significant institutions (SIs) under direct ECB supervision fall outside the MaRisk; third-country branches (§ 53c of the German Banking Act, KWG) are newly covered.
2. New size categories: Less significant institutions (LSIs) are differentiated into "very small", "small" (SNCI) and "other" institutions — with category-specific reliefs.
3. Risk inventory & risk-bearing capacity: Materiality threshold and the validation cycle can be extended.
4. Stress testing: Reduced requirements for small and very small institutions.
5. Risk reporting: Greater flexibility in frequency and design in particular for small institutions.
6. ESG risks: Specific requirements with a focus on environmental and climate risks, as well as scenario analyses.
7. Outsourcing: A central outsourcing officer is no longer mandatory.
8. Lending business: Both additional requirements and simplification in specific areas.
9. European integration: Implementation of CRD VI (where not already covered by the KWG), EBA guidelines and alignment with DORA.

Scope: SIs out, third-country branches in

The most striking structural change: significant institutions under direct ECB supervision no longer fall under the MaRisk. Consistent — the MaRisk are guidelines by which BaFin binds itself in applying § 25a KWG; they have no binding effect on the ECB. It remains to be seen to what extent SIs (and their auditors) will voluntarily continue applying individual MaRisk modules such as the requirements for trading processes.

Newly in scope are third-country branches within the meaning of § 53c KWG — the logical complement to the new KWG requirements introduced by the German act implementing CRD VI (BRUBEG).

New size categories: who counts as a small or very small institution?

Very small institutions

• Criterion: total assets ≤ €1 billion on a four-year average (a pure size criterion)
• Reliefs: all MaRisk opening clauses available, including the SNCI reliefs — without requiring SNCI classification

Small institutions (SNCI)

• Criterion: SNCI criteria under Art. 4(1)(145) CRR, in particular total assets ≤ €5 billion
• Reliefs: validation, stress testing, separation of functions, outsourcing, lending business and reporting

Other LSIs

• All remaining less significant institutions — general proportionality and opening clauses

By BaFin’s estimate, around three quarters of German credit institutions qualify as SNCIs — the amendment matters for the breadth of the market, not just for niches.

The reliefs in detail

Validation and risk-bearing capacity: Follow-up validations will only be required at least every three years and on an ad hoc basis (AT 4.1, 9). The separation between model development and validation may be dispensed with in small institutions. The new 5% materiality threshold (in relation to the risk coverage potential) is an upper bound for a risk classified as immaterial (AT 2.2 , 1) and creates a clear, audit-proof yardstick for the risk inventory.

Outsourcing: A central outsourcing officer is no longer prescribed. Under certain circumstances, it may be possible to fully outsource the specialized functions of risk management, compliance, and internal audit (AT 9, 5).

Stress testing and reporting: Small institutions benefit from reduced stress-testing scope (AT 4.3.3, 3), no requirement for inverse stress tests (AT 4.3.3, 4), and qualitative approaches to environmental risks (AT 4.3.3, 7). Very small institutions are not required to conduct risk-type-specific stress tests (AT 4.3.3, 2). Reporting requirements are becoming more flexible for small institutions: reference to previous reports when there are no changes, no requirement for interim reporting when risks remain stable, and rolling stress test reporting (BT 2.2, 1).

Lending business: The redesign opens up simplification potential, particularly in collateral valuation processes.

ESG risks: specification, not relief

With the amendment, BaFin and the Bundesbank specify the requirements for managing ESG risks under sec. 26c KWG. The focus is on environmental and climate risks; scenario analyses are explicitly required. Institutions that have treated ESG as a qualitative side topic will need to sharpen their risk inventory and scenario capabilities — here the amendment is not a relief but a clarification of supervisory expectations.

More Than Just Relief: Governance and ICT

The requirements for Internal Audit are being moved from the Special Section (BT 2) to the General Section (AT 4), thereby elevating their status. Internal audit is being more closely integrated into the Three Lines and the bank’s overall governance; its planning, auditing, monitoring, and reporting responsibilities are now specifically regulated and, in some cases, further elaborated. What were previously regulatory expectations are now becoming binding standards.

ICT/DOR Strategy and Distinction from DORA: The term “IT” is expanded to “ICT” in accordance with EBA guidelines and DORA; ICT risks are explicitly included in the risk inventory as operational risks. A standalone ICT strategy and a DOR (digital operational resilience) strategy that are aligned with the business strategy are required. The actual management of ICT risks—requirements, controls, and measures—will in the future be governed primarily by DORA. Accordingly ICT outsourcing is removed from the scope of section AT 9 and addressed instead through DORA.

8th vs 9th amendment: the paradigm shift

While the 8th amendment (2024) mainly brought selective additions — on ESG risks and real-estate business, for instance — the 9th amendment changes the structure of the circular itself: additions, deletions, clearer delineation, reordering of text between sections, fewer detailed regulations, and mandatory additional size classes to more explicitly regulate proportionality frameworks and the separation of the SIs. In short: the 8th amendment expanded requirements, the 9th redistributes them — by size, complexity and risk profile.

What institutions should do now: roadmap to 1 January 2027

1. Impact analysis (July–August 2026): Determine your size category (check the SNCI criteria under the CRR) and run a gap analysis against the final version.
2. Decide on reliefs deliberately (September–October): Opening clauses are options, not defaults. Every relief you use needs a documented, risk-based justification — it becomes an audit topic from 2027.
3. Update your documentation (October–November): Update the risk manual, internal guidelines, outsourcing and validation frameworks to the new structure; set up ESG scenario analyses.
4. Involve internal audit & the supervisory board (December): Document the implementation status in an audit-proof way.

ADVISORI supports your MaRisk implementation — from gap analysis and the deliberate use of opening clauses to audit-proof documentation. See also: MaRisk Ongoing Compliance and MaRisk Audit Readiness.

FAQ: the 9th MaRisk Amendment

When does the 9th MaRisk Amendment come into force?

The final version was published on 30 June 2026. The relief measures are effective immediately, while a transition period applies to the new requirements until January 1, 2027; the new requirements are therefore not part of the 2026 annual financial statement audit.

What changes with the 9th MaRisk Amendment?

The MaRisk become more proportionate: new size categories with reliefs for small and very small institutions; other changes include a 5% materiality threshold, extended validation cycles, more flexible stress testing and reporting, no mandatory central outsourcing officer, and specified ESG requirements.

Which institutions fall outside the MaRisk now — and who is newly covered?

Significant institutions (SIs) under direct ECB supervision are carved out of the scope. Newly covered are third-country branches under sec. 53c of the German Banking Act (KWG) — relevant for foreign banking groups with German branches.

What are small and very small institutions (SNCIs)?

Very small institutions have total assets of at most €1 billion on a four-year average. Small institutions (SNCIs) meet the criteria of Art. 4(1)(145) CRR, in particular total assets up to €5 billion. Around three quarters of German institutions qualify as SNCIs according to BaFin.

Is a central outsourcing officer still mandatory?

No. Outsourcing may be monitored on a decentralised basis within the business units, provided control functions remain separate from operational activities.

What is the 5% materiality threshold?

This applies to each individual risk category: A risk that does not exceed 5% of the risk coverage potential may be classified as immaterial in the economic perspective (AT 2.2, 1). This is an upper limit — the internal standard of an institution may be stricter. However, multiple risks that are individually immaterial but become material when combined must still be appropriately taken into account in the risk-bearing capacity (AT 4.1, para. 1); conversely, there is no fixed 5% limit for the sum of all immaterial risks.

Do institutions have to use the SNCI reliefs?

No — opening clauses are options. Any relief used should be justified on a risk basis and documented, as supervisors will scrutinise their use from 2027.

Conclusion

The 9th MaRisk Amendment does not redefine the principles-based framework of MaRisk, but for the first time, proportionality is operationalized through binding size categories with specifically assigned exceptions. Unlike earlier revisions—particularly the 7th amendment—this amendment not only expands the scope of MaRisk but also, in some cases, reduces the regulatory burden. This relief may be particularly noticeable for small and very small institutions. However, this does not happen automatically: It requires that an institution accurately determine its size category, use the exemption clauses in a deliberate and risk-based manner, and document this. At the same time, the amendment introduces additional requirements in specific areas—particularly regarding ESG risks—so that “relief” does not apply to all issues or to all categories of institutions.

Sources: BaFin, announcement of 30 June 2026 ("MaRisk-Novelle: Mehr Proportionalität"); BaFin Consultation 02/2026; supervisory briefing of 19 June 2026.