BaFin WpI MaRisk sets a new risk rulebook for small and midsized German investment firms from Jan. 1, 2027. BaFin published the circular on Monday. The framework covers firms that execute client orders, trade derivatives, or hold client money. However, brokers licensed as banks will stay under separate banking standards.
The new circular replaces the use of bank-focused MaRisk for the two smaller classes of investment firm. BaFin said the separate framework should give more legal clarity. It also said the rules better reflect business models that differ from credit institutions.
BaFin WpI MaRisk Sets Core Controls
Covered firms must identify key risks across their business. Those risks include threats to customers, markets, and the firm itself. Additionally, firms must include information and communications technology risks. BaFin also treats environmental, social and governance factors as possible drivers of other risks.
BaFin said customer risk can include poor or unsuitable investment advice, weak controls, and trading or valuation mistakes. Actions by tied agents also fall into that category. Meanwhile, system and process outages are listed as risks too. Firms that do not segregate client money must reflect that setup in their customer-risk review.
Investment firms must keep trading separate from risk management, settlement, and control functions, including at management level. Still, BaFin allows an exception when trading activity is small and not complex. Firms must monitor trades on an ongoing basis. They must also check discrepancies quickly and record positions in risk systems without delay.
Medium Firms Face Added Requirements
Medium firms must apply tighter controls when position losses are material. They must set limits for counterparty, issuer, and market-price risk. They must also track those limits and document any breaches and fixes. In addition, firms must value trading-book positions every day and combine them into one overall risk position at least daily.
Positions in the investment book with market-price risk need valuation at least every quarter. More frequent checks are required when the activity justifies them. Small and medium firms must also prepare a multiyear capital plan. That plan must cover the expected case and at least one adverse scenario.
Every covered firm needs a compliance function. Separate risk management and internal audit are required when size and complexity make them proportionate. The rules also require contingency plans for critical or important functions. Outsourcing must sit in a central management framework with a full register, service reviews, and controls over subcontracting chains.
Until the new circular starts, small and medium German investment firms will keep using bank MaRisk, while large investment firms will remain under the bank framework after Jan. 1.
You can access our other news on brokers and global market developments here.
Source: Finance Magnates
