Skip to main content

​
Getting Started with BaFin MaRisk

MaRisk (Mindestanforderungen an das Risikomanagement) is BaFin’s circular on the minimum requirements for risk management in German credit institutions and financial services institutions. It implements the EBA Guidelines on internal governance and translates Basel requirements into binding supervisory expectations for the German market. The current version (MaRisk 7.0, effective 2023) incorporates requirements from the EBA Guidelines on ICT and security risk management, making it directly relevant to operational resilience and IT governance. MaRisk applies to all institutions supervised by BaFin under the KWG (German Banking Act). Matproof maps MaRisk requirements to controls, policies, and evidence workflows so you can demonstrate compliance during BaFin audits and Section 44 KWG examinations.
Activate MaRisk under Settings - Frameworks - BaFin MaRisk. Controls are pre-populated across all MaRisk modules (AT, BT, BTR).

​
Am I in Scope?

MaRisk applies to:
  • Credit institutions (Kreditinstitute) under Section 1(1) KWG
  • Financial services institutions (Finanzdienstleistungsinstitute) under Section 1(1a) KWG
  • Payment institutions and e-money institutions (to the extent BaFin circular applies)
  • Groups of institutions at both individual entity and group level
MaRisk applies proportionally. Smaller, less complex institutions may implement simplified approaches where the circular explicitly allows it. Document your proportionality assessment in your risk management framework.

​
MaRisk Structure

MaRisk is organized into modules:
ModuleScopeMatproof Module
AT (Allgemeiner Teil)General requirements: governance, risk strategy, internal controls, outsourcingPolicies, Controls, Vendor Risk
AT 7IT resources and IT risk management (incorporates EBA ICT Guidelines)Controls, Evidence
AT 9OutsourcingVendor Risk
BT (Besonderer Teil)Specific requirements for organizational structure and processesControls
BT 1Lending businessControls
BT 2Trading businessControls
BT 3Internal control system requirementsControls, Audit Programs
BTRRisk types: credit, market, liquidity, operational riskRisk Management

​
Key Requirements in Matproof

Risk Strategy

Policies, Risk ManagementDocument a risk strategy consistent with the business strategy. The management board is responsible for defining the institution’s risk appetite and ensuring adequate risk management.

IT Governance (AT 7)

Controls, EvidenceImplement IT risk management covering IT strategy, information security, IT operations, and IT project management. This module now incorporates EBA ICT Guidelines requirements.

Outsourcing (AT 9)

Vendor RiskClassify outsourced activities by materiality. Material outsourcing requires risk analysis, contractual safeguards, exit strategies, and ongoing monitoring.

Internal Control System

Controls, Audit ProgramsMaintain the three lines of defense: operational management, risk management and compliance, and internal audit. Document segregation of duties.

Operational Risk

Risk Management, IncidentsIdentify, assess, and manage operational risks including IT failures, fraud, and process errors. Maintain a loss database and report material incidents.

Business Continuity

Policies, ControlsMaintain business continuity plans for time-critical activities and processes. Test plans regularly and document results.
1
Step 1 - Document your risk strategy and governance
2
MaRisk AT 4.2 requires a written risk strategy derived from the business strategy:
3
  • Go to Policies - Generate and create your Risk Management Framework Policy
  • Document the management board’s risk appetite statement
  • Define roles and responsibilities for risk management across the three lines of defense
  • Ensure the supervisory board (Aufsichtsrat) receives regular risk reporting
    • 4
    Step 2 - IT risk management (AT 7)
    5
    AT 7 is one of the most operationally intensive MaRisk modules:
    6
  • Document your IT strategy and ensure it aligns with the business strategy
  • Complete controls for information security management (AT 7.2)
  • Document IT operations including change management and incident handling (AT 7.3)
  • Establish IT project management governance with risk assessment for major projects (AT 7.4)
  • Define access rights management (AT 7.2) with regular recertification
    • 7
    BaFin examiners pay close attention to AT 7 implementation. Ensure your information security officer (ISB) has sufficient authority and reports directly to the management board.
    8
    Step 3 - Outsourcing register and risk assessments (AT 9)
    9
  • Go to Vendor Risk and create a complete outsourcing register
  • Classify each outsourced activity as material or non-material
  • For material outsourcing: conduct a risk analysis, verify contractual clauses (including BaFin audit rights), and document exit strategies
  • Establish ongoing monitoring with defined escalation criteria
  • Ensure BaFin notification requirements are met for material outsourcing arrangements
    • 10
    Step 4 - Internal control system and segregation of duties
    11
  • Document your three lines of defense model
  • Map key processes and verify segregation of duties (AT 4.3.1)
  • Ensure the compliance function covers all regulatory requirements and reports to the management board
  • Document the internal audit function’s scope, independence, and reporting line
    • 12
    Step 5 - Operational risk management
    13
  • Go to Risk Management - New Risk Assessment for operational risk
  • Document your operational risk identification and assessment methodology
  • Set up the Incidents module for operational loss event tracking
  • Define risk indicators (KRIs) and escalation thresholds
  • Ensure operational risk is included in the overall risk reporting
    • 14
    Step 6 - Business continuity management
    15
  • Identify time-critical activities and processes
  • Go to Policies - Generate and create your Business Continuity Policy
  • Document recovery time objectives (RTOs) and recovery point objectives (RPOs)
  • Conduct and document BCP tests at least annually
  • Link test results as evidence against the relevant MaRisk controls
    • 16
    Step 7 - Internal audit and gap review
    17
  • Go to Audit Programs - New Audit - MaRisk
  • Run an internal audit covering all MaRisk modules
  • Document findings as Corrective Actions with remediation timelines
  • Ensure the audit report is presented to the management board and supervisory board

    • ​
    Common BaFin Examination Findings

    FindingHow to Avoid
    Incomplete outsourcing registerInclude all outsourced activities, not just IT. Review procurement records for missed arrangements.
    IT risk management gaps (AT 7)Ensure the ISB role is formally established with clear authority. Document IT risk assessments for all critical systems.
    Missing segregation of dutiesMap dual-control requirements for all risk-relevant processes. Document compensating controls where full segregation is not feasible.
    Insufficient BCP testingTest plans annually at minimum. Document test scenarios, results, and improvement actions.
    Risk reporting gapsEnsure ad-hoc reporting triggers are defined and management board reporting covers all material risk types.

    ​
    Relationship to Other Frameworks

    FrameworkOverlap with MaRisk
    DORADORA supersedes parts of MaRisk AT 7 for ICT risk. Institutions in scope for DORA should implement both, with DORA taking precedence for ICT-specific requirements.
    ISO 27001Strong overlap with AT 7 information security requirements. ISO 27001 certification can serve as evidence for many AT 7 controls.
    EBA GuidelinesMaRisk 7.0 incorporates EBA Guidelines on internal governance and ICT security risk management. Compliance with MaRisk generally satisfies the underlying EBA requirements.

    ​
    Next Steps

    • Risk Management - building your MaRisk-compliant risk assessment framework
    • Vendor Risk - outsourcing register and material outsourcing assessments
    • Incidents - operational loss event tracking and reporting
    • Audit Programs - internal audit planning for BaFin examinations