Germany's Federal Financial Supervisory Authority (BaFin) has issued a dedicated risk-management rulebook for small and midsized investment firms, replacing the previously analogous use of bank-focused MaRisk for these entities. The new WpI MaRisk circular was published on August 24, 2026, and will take effect on January 1, 2027.
For retail trading companies, the framework covers firms that execute client orders, deal in derivatives or hold client money. German entities operated by CFD and FX groups may fall within the scope, while brokers licensed as banks remain subject to separate banking standards. Under the EU's Investment Firms Regulation, a CFD dealer that holds client money or takes market risk cannot use the small-firm classification.
Shift to a dedicated investment firm framework
BaFin stated that the separate WpI MaRisk framework is intended to provide greater legal clarity and to reflect operating models that differ from those of credit institutions. Covered firms must identify material risks across their operations, including risks to customers, markets and the firm itself. Information and communications technology risks must be included explicitly, while environmental, social and governance factors are treated as potential drivers of other risks.
Within the customer-risk category, BaFin highlights unsuitable or inadequate investment advice, failed control procedures, trading and valuation errors, and actions by tied agents. System and process outages are also listed as customer risks. Firms that do not segregate client money must incorporate that structure into their customer-risk assessment.
Governance, trading controls and capital planning
The circular requires investment firms to separate trading from risk management, settlement and control functions at the management level. Trades must be monitored continuously, with discrepancies investigated promptly and positions recorded in risk systems without delay. Medium firms face more detailed controls when losses from their positions are material. They must establish counterparty, issuer and market-price risk limits, monitor their use, and document breaches and related remedial measures.
Trading-book positions must be valued daily and combined into an overall risk position at least once each day. Small and medium firms must prepare a multiyear capital plan tied to their operations and risk management, incorporating an expected-case scenario and at least one adverse scenario.
Compliance, outsourcing and wind-down planning
Every covered firm must have a compliance function. A separate risk-management function and internal audit are required where proportionate to the size and complexity of the firm's operations. The rules also mandate contingency planning for critical or important functions.
Outsourcing arrangements must be embedded in a central management framework that includes a complete register of outsourced activities, ongoing reviews of service quality and controls covering subcontracting chains. Medium firms must estimate how long an orderly wind-down would take and what it would cost.
Until the new WpI MaRisk circular takes effect on January 1, 2027, small and medium German investment firms will continue to apply the existing bank MaRisk standards.
