The Federal Financial Supervisory Authority has issued minimum risk management requirements for small and medium investment firms, effective Jan. 1, 2027. The framework applies proportionately to these firms and their foreign branches, while large investment firms remain subject to the risk management requirements under the German Banking Act. It also implements relevant European Banking Authority guidelines on internal governance and the suitability of management body members and key function holders. Firms must maintain governance, internal controls and risk processes covering material risks to clients, markets and the firm, as well as liquidity and other risks. Risk inventories must explicitly address information and communications technology risks and reflect environmental, social and governance risks as risk drivers. All firms must conduct multiyear capital planning that includes an adverse scenario, while medium investment firms face additional requirements for risk-bearing capacity, stress testing and assessment of orderly wind-down risks. The framework also sets expectations for compliance, risk management and internal audit functions, trading controls, risk reporting and outsourcing, including central outsourcing management and registers. Information and communications technology services governed by the Digital Operational Resilience Act are excluded from the outsourcing section.
2026-08-24BaFin
Germany's Federal Financial Supervisory Authority issues risk management requirements for small and medium investment firms
The Federal Financial Supervisory Authority has issued proportionate risk management requirements for small and medium investment firms, effective Jan. 1, 2027. The framework covers governance, capital planning, material risk management, control functions, reporting and outsourcing, with additional risk-bearing capacity, stress-testing and orderly wind-down requirements for medium firms.