Choose the regulatory path for your firm. Each question connects the requirement, its purpose and the operational evidence; expand it for triggers, owners and common gaps.
These review paths are editorial implementation examples, not an individual supervisory finding. The statuses are local to this browser view and are not saved.
14 high-level questions for the applicable framework, including risk inventory, capacity, controls, continuity and reporting.
Determine the firm type, activities and applicable MaRisk modules.
Only applicable obligations can be implemented effectively.
Reasoned applicability matrix, reviewed when the model changes.
Identify material risks across the firm; consider concentrations and ICT and ESG risk drivers.
Unknown or aggregated risks cannot be controlled.
Overall risk profile with materiality decisions and actions.
Management retains overall responsibility; the supervisory body fulfils its oversight role.
Risk control needs decisions and effective challenge.
Regular reporting, decisions and tracked findings.
Align risk-bearing capacity with the overall risk profile and available capital.
Material risks must remain supportable.
Defined perspectives, limits, recurring calculation and escalation.
Define, align and review strategies and translate them into steering.
Growth and risk appetite must remain consistent.
Approved goals, limits and documented review.
Design responsibilities, separation of duties and risk control processes.
Uncontrolled decisions and hidden conflicts amplify losses.
Process owners, measurement, monitoring and corrective action.
Review stress scenarios and models in proportion to the risks.
Normal data may conceal extreme events and model weakness.
Scenarios, assumptions, model controls and decisions.
Provide and involve risk control, compliance and internal audit as applicable.
Independent functions identify and review weaknesses.
Mandates, resources, reporting lines and remediation.
Keep policies current, document decisions and provide adequate staff and technology.
Controls work only when people and systems can execute them.
Versioned rules, training, records and capacity planning.
Plan and test the recovery of critical processes.
Outages must not interrupt material functions without control.
Scenarios, owners, recovery plan and test evidence.
Assess new products, material changes and outsourcing before launch and during operation.
New interfaces can create risks before teams recognise them.
Approval, provider oversight, controls and exit planning.
Apply activity-specific process and segregation rules where these businesses are conducted.
Different activities require different controls.
Relevant approval, settlement and monitoring steps.
Manage credit, market, liquidity, operational and relevant banking-book spread risks.
The overall risk profile needs active management of its components.
Indicators, limits, concentrations and actions by risk type.
Report risk information to management clearly and in time.
Decisions depend on visible changes.
Reports on material risks, limits, findings and actions.
13 high-level questions for preparation ahead of 1 January 2027. Separate from the bank framework.
From 1 January 2027, assess scope for small and medium investment firms; large firms follow the KWG framework.
The wrong regime creates gaps and misplaced obligations.
Documented classification and implementation plan.
Inventory risks to clients, the market and the firm, as well as other and liquidity risks.
Investment-service-specific exposures must be visible.
Overall risk profile, concentrations and reasoned materiality.
Take effective responsibility for organisation and risk management.
Delegation does not remove steering and oversight duties.
Reports, decisions, escalation and action follow-up.
Assess appropriate risk capacity and capital planning for the firm size.
Risks and business plans need adequate financial resources.
Capital assumptions, forecasts and options for action.
Connect business and risk strategies.
A new service changes exposures and resource needs.
Approved strategy with reviewable risk objectives.
Design organisation, risk identification, control and proportionate stress testing.
Errors in digital journeys can scale quickly.
Owners, controls, scenarios and fixes in live workflows.
Establish risk management, compliance and internal audit to the applicable extent.
Controls must challenge decisions and follow up issues.
Clear mandates, resources and reports to management.
Maintain proportionate policies, records, staff, technology and continuity arrangements.
Processes must survive staff and system disruption.
Current instructions, capacity and tested recovery.
Assess new products and material changes before launch for risks and control readiness.
A launch may create client, market or firm risks.
Approval with risk assessment, owners and tested implementation.
Select, contract and monitor outsourced activities based on risk.
An external provider does not replace firm accountability.
Register, diligence, oversight, escalation and exit.
Address specific trading and tied-agent requirements when applicable.
These service chains need clear segregation and monitoring.
Trading controls, interfaces and agent oversight.
Manage client, market, firm and liquidity risks and disorderly wind-down.
Harm extends beyond the balance sheet to clients and market integrity.
Indicators, scenarios and actions for each relevant risk.
Report material risks clearly and promptly.
Management needs information to respond.
Targeted reports with escalation and decisions.
Review status:
Sources: BaFin Circular 06/2026 (BA), 30 June 2026, and Circular 09/2026 (WA), 24 August 2026. This is a selective high-level translation into operational review questions. It is not a complete obligations register. Confirm the rules applicable to your firm and subsequent changes.
Did you know?
How an app can become an activity that requires permission.
Have you explored?
Prepare management profiles and collective suitability reviews.
International market entry / Germany
Considering a local office, a branch or a standalone authorisation in Germany? The appropriate route depends on your home jurisdiction, activities and operating model. 3RMCN combines experience from complex supervisory projects with product, technology and delivery expertise: from entry strategy and key interfaces through to operational readiness.
Discuss your plans ↗Supervisory perspectives
Experience in the context of CySEC (Cyprus), MFSA (Malta), FCA (United Kingdom), the European ESMA framework and MAS (Singapore). ESMA is not a national licensing authority.
International structuring
For incorporation in offshore jurisdictions, relevant specialists from the network can be involved. Jurisdiction, activities and regulatory obligations need to be considered for each project.