Skip to main content

​
Getting Started with BaFin MaRisk

MaRisk (Mindestanforderungen an das Risikomanagement) is BaFin’s circular on the minimum requirements for risk management in German credit institutions and financial services institutions. It implements the EBA Guidelines on internal governance and translates Basel requirements into binding supervisory expectations for the German market. The current version (MaRisk 7.0, effective 2023) incorporates requirements from the EBA Guidelines on ICT and security risk management, making it directly relevant to operational resilience and IT governance. MaRisk applies to all institutions supervised by BaFin under the KWG (German Banking Act). Matproof maps MaRisk requirements to controls, policies, and evidence workflows so you can demonstrate compliance during BaFin audits and Section 44 KWG examinations.
Activate MaRisk under Settings - Frameworks - BaFin MaRisk. Controls are pre-populated across all MaRisk modules (AT, BT, BTR).

​
Am I in Scope?

MaRisk applies to:
  • Credit institutions (Kreditinstitute) under Section 1(1) KWG
  • Financial services institutions (Finanzdienstleistungsinstitute) under Section 1(1a) KWG
  • Payment institutions and e-money institutions (to the extent BaFin circular applies)
  • Groups of institutions at both individual entity and group level
MaRisk applies proportionally. Smaller, less complex institutions may implement simplified approaches where the circular explicitly allows it. Document your proportionality assessment in your risk management framework.

​
MaRisk Structure

MaRisk is organized into modules:

​
Key Requirements in Matproof

Risk Strategy

Policies, Risk ManagementDocument a risk strategy consistent with the business strategy. The management board is responsible for defining the institution’s risk appetite and ensuring adequate risk management.

IT Governance (AT 7)

Controls, EvidenceImplement IT risk management covering IT strategy, information security, IT operations, and IT project management. This module now incorporates EBA ICT Guidelines requirements.

Outsourcing (AT 9)

Vendor RiskClassify outsourced activities by materiality. Material outsourcing requires risk analysis, contractual safeguards, exit strategies, and ongoing monitoring.

Internal Control System

Controls, Audit ProgramsMaintain the three lines of defense: operational management, risk management and compliance, and internal audit. Document segregation of duties.

Operational Risk

Risk Management, IncidentsIdentify, assess, and manage operational risks including IT failures, fraud, and process errors. Maintain a loss database and report material incidents.

Business Continuity

Policies, ControlsMaintain business continuity plans for time-critical activities and processes. Test plans regularly and document results.

​
Common BaFin Examination Findings

​
Relationship to Other Frameworks

​
Next Steps

  • Risk Management - building your MaRisk-compliant risk assessment framework
  • Vendor Risk - outsourcing register and material outsourcing assessments
  • Incidents - operational loss event tracking and reporting
  • Audit Programs - internal audit planning for BaFin examinations