The 9th MaRisk amendment: what BaFin's 2026 reform means for your risk management

A MaRisk amendment that changes a great deal at its core

On 1 April 2026, BaFin opened the draft of the 9th amendment to the Minimum Requirements for Risk Management (MaRisk) for public consultation. The comment period ran until 8 May 2026. What follows is one of the most far-reaching revisions of MaRisk since its introduction.

BaFin's message is clear: away from checkbox compliance, toward genuine, principles-based risk management. At the same time, smaller and less complex institutions are meant to see tangible relief. And with the new EBA guidelines on climate scenario analysis, binding requirements on climate-related risks enter MaRisk for the first time.

This article explains the key changes and what your institution should prepare now.

The core of the reform: principles instead of rules

Over the years, MaRisk had become increasingly complex. Each amendment added new detailed requirements, with the result that compliance teams spent more time documenting process details than on actual risk management.

The 9th amendment reverses this trend. The circular is being fundamentally reworked:

• More principles-based: instead of specific process rules, BaFin formulates goals and principles. Institutions get more room to shape their own approach, but must be able to justify why their chosen methods are suitable.
• Significantly reduced complexity: redundant requirements are removed, wording is simplified, and the structure of the circular is organized more clearly.
• Stronger proportionality: what applies to a large bank should apply to a savings bank with a regional customer base in an appropriately modified, suitable way.

For compliance teams, this means less copying of wording from the circular into internal documentation, but more conceptual work justifying their own approach.

Proportionality: around 950 institutions benefit

A central promise of the 9th amendment is relief for small and medium-sized institutions. According to BaFin, around 950 institutions, roughly three-quarters of all German credit institutions, benefit from the planned relief and clarifications.

Specifically, this means, among other things:

• Simplified requirements for documenting risk-control processes for institutions below certain size and complexity thresholds
• Clearer distinction of which AT sections are mandatory or recommended for which types of institution
• Reduced burden of justification for deviations from the standard case

For larger and more complex institutions, the requirements remain demanding, with the added dimension of the new climate requirements.

New: climate-related risks become mandatory

Probably the most far-reaching substantive addition of the 9th MaRisk amendment is the integration of the EBA guidelines on environmental scenario analysis (EBA/GL/2025/04) and on internal governance.

From 1 January 2027, credit institutions are required to systematically factor climate-related risks into their risk management. Specifically, this means:

• Climate risk analysis as a mandatory component: physical risks such as extreme weather events and natural disasters, as well as transition risks such as tighter regulation and market shifts from the energy transition, must be identified, assessed, and documented.
• What-if scenarios for resilience: institutions must develop scenarios showing how resilient their business model is under different climate scenarios, for example an accelerated coal phase-out or an increase in physical damage in certain regions.
• Integration into the ICAAP: climate risks must be integrated into the internal capital adequacy assessment process.

This is a substantial requirement, especially for institutions that have so far treated climate risk mainly as an ESG communications topic. MaRisk turns it into a hard supervisory obligation with direct relevance to examinations.

The new EBA guidelines on internal governance

Alongside the climate requirements, the 9th MaRisk amendment also implements the EBA guidelines on internal governance. These particularly concern:

• Requirements for senior management: greater responsibility of executives for the risk management system, improved supervisory board competencies
• The risk management function: clarifying the role and authority of the Chief Risk Officer and the associated unit
• Risk culture: requirements for a risk culture that is actually lived within the institution, not just documented

The last point stands out in particular: going forward, BaFin will also assess the risk culture actually lived within an institution, not just its formal documentation.

What changes for supervisory practice

The 9th MaRisk amendment also changes how BaFin examinations will work. The principles-based approach means more qualitative review. Examiners won't just check off documented processes, they'll ask why an institution chose a particular approach and how it ensures that approach fits its own risk situation.

Institutions that deviate from common market practice must be able to substantially justify the suitability of their methods. From 2027, climate documentation also becomes an explicit subject of examination: examiners will then assess the quality of climate risk analyses, not just their formal existence.

For compliance teams, this means preparing for MaRisk examinations becomes conceptually more demanding. Time that used to go into checkbox documentation now needs to go into substantive justification work.

Timeline and next steps

The final version of the 9th MaRisk amendment is expected once the consultation concludes. For implementation, the following timeline is recommended.

Immediately, still in 2026

• Run a gap analysis against the consultation draft
• Design the climate risk analysis process: data sources, scenarios, governance
• Carry out a proportionality assessment to clarify which relief your institution can benefit from

By the end of 2026

• Adapt internal governance documentation to the new EBA requirements
• Extend the ICAAP process with a climate component
• Train senior management and risk control staff

By 1 January 2027

• Full integration of climate-related risks into risk management
• Auditable documentation of the what-if scenarios

Conclusion

The 9th MaRisk amendment isn't an incremental adjustment, it's a fundamental reform of the German risk management framework. Principles orientation, climate risk integration, and new governance requirements confront compliance teams with substantial conceptual work.

At the same time, the amendment offers a genuine opportunity. Institutions that have so far treated compliance mainly as a documentation task can use the reform to build risk management that creates real value.

conformis maps every MaRisk AT section directly to your policies and controls and automatically updates the mapping whenever a new amendment is published. That way, you're immediately up to date with every revision.