Key provisions of the amendments to MaRisk
Consideration of ESG risks
With the 7th MaRisk amendment in June 2023, ESG risks were integrated along the existing MaRisk modules. The effects of ESG risks were factored into the risk inventory, risk-bearing capacity, business strategy, risk management and controlling processes, internal stress tests and risk reporting.
In addition, the requirements for granting and monitoring loans have been expanded, and procedural requirements for the real estate business have been introduced in analogy to the credit processes.
Interest rate and credit spread risks in the banking book
The 8th MaRisk amendment, which came into effect in May 2024, implemented the EBA guidelines on interest rate risks and credit spread risks in the banking book (EBA/GL/2022/14).
Accordingly, it is possible to treat interest rate risks separately in the trading and banking books or to integrate them at the level of the entire institution. However, the decisive factor is that both the earnings-oriented perspective and the present value perspective are taken into account in the measurement and management of interest rate risks. This applies analogously to the determination of credit spread risks in the banking book. The standards for determining, identifying, and assessing credit spread risks are outlined in BTR 5.
Principle-based regulation, proportionality and integration of ESG and DORA requirements
With the 9th amendment, now available in the consultation version dated April 1, 2026, small and less complex institutions are relieved from administrative requirements, thereby strengthening double proportionality. Significant institutions (SI), which are directly supervised by the European Central Bank (ECB), are removed from the scope of MaRisk. The institutions remaining within the scope are divided into the following three size categories:
- Very small institutions (balance sheet total up to one billion euros),
- Small institutions according to Art. 4 Para. 1 No. 145 CRR (SNCI),
- Other less significant institutions (LSI).
Complexity reductions arise both in the general part and the special part of MaRisk. This particularly affects provisions on risk-bearing capacity determination and stress tests, outsourcing management, compliance function, internal audit as well as risk reporting. Overall, specific requirements are replaced by significantly more principle-oriented formulations and previous redundancies are eliminated.
To avoid double regulation, ICT services falling under DORA have been excluded from the scope of AT 9 MaRisk. Nevertheless, each institution must have a consistent and sustainable ICT strategy.
The 9th amendment concretizes ESG risk management pursuant to § 26c KWG and implements the new EBA guidelines on ESG risks and environmental scenario analyses on a principles-based basis. For the first time, it contains its own definition of ESG risks, aligned with the CRR: These are events or conditions from environmental, social, and corporate governance that act as risk drivers for the main risk types (credit risk, market risk, liquidity risk, operational risk).
Clearer requirements regarding emergency management result from the amendment: For critical or important functions, emergency concepts must specify objectives, measures, and responsibilities for continuation or restoration. Criteria for classification and triggering of emergency plans must also be defined. New is the explicit obligation to carry out business impact analyses, in which the effects of disruptions on business operations are assessed over graduated periods of time.
