BaFin Introduces New WpI MaRisk Risk Management Requirements for Investment Firms
- The German Federal Financial Supervisory Authority, known as BaFin, has published a draft of its new risk management framework tailored specifically for small and medium-sized investment firms, according...
- According to BaFin, the new circular addresses small and medium-sized investment firms and establishes clear legal standards for risk management.
- The draft introduces significant structural changes to how firms calculate risk-bearing capacity and manage capital.
The German Federal Financial Supervisory Authority, known as BaFin, has published a draft of its new risk management framework tailored specifically for small and medium-sized investment firms, according to official regulatory announcements from August 2025. The upcoming regulation, designated as WpI MaRisk, creates an independent and proportionate supervisory standard that replaces the previous blanket application of bank-oriented rules.
A Tailored Regulatory Framework Under WpI MaRisk
According to BaFin, the new circular addresses small and medium-sized investment firms and establishes clear legal standards for risk management. Previously, these institutions had to apply the Minimum Requirements for Risk Management designed for credit institutions, known as MaRisk for banks, on a proportional basis. KPMG notes that this previous requirement led to divergent interpretations among firms, auditors, and regulators since the introduction of the European Investment Firms Regulation and Investment Firms Directive in June 2021. Jörg Streißle, an attorney at the firm Annerton, explains that BaFin intends to focus consistently on proportionality and significantly streamlined specifications through the new framework. The formal transition is set for January 1, 2027. Until that date, smaller and medium-sized firms must continue applying the credit institution standards, though they are permitted to incorporate changes from the ninth MaRisk amendment during the interim period. Large investment firms will continue to follow the standard rules established for traditional banks.
Restructured Risk Assessment and Capital Planning
The draft introduces significant structural changes to how firms calculate risk-bearing capacity and manage capital. According to KPMG reporting, the previous requirement to maintain separate normative and economic perspectives has been eliminated to reduce administrative burdens. Instead, medium-sized investment firms will calculate risk-bearing capacity across three distinct risk classes: Risk to Firm, Risk to Client, and Risk to Market. This categorization aligns directly with the K-factor model established under the European Investment Firm Regulation. In addition to these metrics, firms must explicitly account for additional risks, including environmental, social, and governance risk drivers. Capital planning will similarly shift away from dual perspectives toward an integrated model that accounts for adverse financial scenarios.
Implementation Challenges and Industry Impact
While the proportionality principle grants smaller institutions greater methodological freedom and reduces overall regulatory complexity, it introduces specific operational challenges. KPMG analysis indicates that firms belonging to broader banking or insurance groups must map the new WpI MaRisk categories back to older risk taxonomies to maintain unified group reporting. Standalone firms, meanwhile, must review their entire risk management lifecycle, from initial inventory and assessment to internal and external reporting. Identifying and evaluating environmental, social, and governance risk drivers presents an additional hurdle due to data availability constraints and distinct business models. The consultation period provides institutions with a structured window to adjust their internal governance structures before the regulation becomes mandatory at the start of 2027.
