Annex 2: All Changes to the Minimum Requirements for Risk Management (MaRisk) Compared to the Version of 29.06.2023

Minimum Requirements for Risk Management - MaRisk Changes compared to the MaRisk version of 29.06.2023 29.05.2024

Annex 2: MaRisk of 29.05.2024 – All Changes Compared to the MaRisk Version of 29.06.2023

Table of Contents
AT 1 Preamble ...................................................................................................................................................................................................................................................................................9
AT 2 Scope of Application ......................................................................................................................................................................................................................................................................12
AT 2.1 Target Group.....................................................................................................................................................................................................................................................................13
AT 2.2 Risks....................................................................................................................................................................................................................................................................................14
AT 2.3 Transactions ..............................................................................................................................................................................................................................................................................15
AT 3 Overall Responsibility of the Management Board .........................................................................................................................................................................................................................18
AT 4 General Requirements for Risk Management ....................................................................................................................................................................................................19
AT 4.1 Risk Capacity .............................................................................................................................................................................................................................................................19
AT 4.2 Strategies..............................................................................................................................................................................................................................................................................23
AT 4.3 Internal Control System ...................................................................................................................................................................................................................................................27
AT 4.3.1 Structural and Process Organization.........................................................................................................................................................................................................................27
AT 4.3.2 Risk Steering and Controlling Processes...................................................................................................................................................................................................28
AT 4.3.3 Stress Tests ...................................................................................................................................................................................................................................................................29
AT 4.3.4 Data Management, Data Quality and Aggregation of Risk Data ..................................................................................................................................................31
AT 4.3.5 Use of Models...................................................................................................................................................................................................................................33
AT 4.4 Special Functions......................................................................................................................................................................................................................................................35
AT 4.4.1 Risk Controlling Function ....................................................................................................................................................................................................................................35
AT 4.4.2 Compliance Function..............................................................................................................................................................................................................................................37
AT 4.4.3 Internal Audit ........................................................................................................................................................................................................................................................38
AT 4.5 Risk Management at Group Level ......................................................................................................................................................................................................................40
AT 5 Organizational Policies ................................................................................................................................................................................................................................................................42
AT 6 Documentation................................................................................................................................................................................................................................................................................43
AT 7 Resources........................................................................................................................................................................................................................................................................................44
AT 7.1 Personnel.................................................................................................................................................................................................................................................................................44
AT 7.2 Technical and Organizational Equipment ...................................................................................................................................................................................................................45
AT 7.3 Emergency Management ..........................................................................................................................................................................................................................................................47
AT 8 Adaptation Processes......................................................................................................................................................................................................................................................................49
AT 8.1 New Product Process........................................................................................................................................................................................................................................................49
AT 8.2 Changes to Operational Processes or Structures .............................................................................................................................................................................................51
AT 8.3 Acquisitions and Mergers ............................................................................................................................................................................................................................................52
AT 9 Outsourcing......................................................................................................................................................................................................................................................................................53
BT 1 Special Requirements for the Internal Control System ...............................................................................................................................................................................................62
BTO Requirements for Structural and Process Organization ...................................................................................................................................................................................................63

Federal Financial Supervisory Authority (BaFin)
Annex 2: MaRisk of 29.05.2024 – All Changes Compared to the MaRisk Version of 29.06.2023

BTO 1 Credit Business......................................................................................................................................................................................................................................................................66
BTO 1.1 Separation of Functions and Veto Rights......................................................................................................................................................................................................................66
BTO 1.2 Requirements for Processes in Credit Business .......................................................................................................................................................................................71
BTO 1.2.1 Granting of Credit.............................................................................................................................................................................................................................................77
BTO 1.2.2 Further Processing of Credit ...............................................................................................................................................................................................................................79
BTO 1.2.3 Control of Credit Processing ........................................................................................................................................................................................................................81
BTO 1.2.4 Intensive Care ...........................................................................................................................................................................................................................................81
BTO 1.2.5 Treatment of Problem Loans.............................................................................................................................................................................................................82
BTO 1.2.6 Risk Provisions..................................................................................................................................................................................................................................................84
BTO 1.3 Requirements for Procedures for Early Detection of Risks and Treatment of Forbearance...............................................................................................85
BTO 1.3.1 Procedures for Early Detection of Risks..............................................................................................................................................................................................85
BTO 1.3.2 Treatment of Forbearance .....................................................................................................................................................................................................................86
BTO 1.4 Risk Classification Procedures.............................................................................................................................................................................................................................88
BTO 2 Trading Business..................................................................................................................................................................................................................................................................89
BTO 2.1 Separation of Functions ...................................................................................................................................................................................................................................................89
BTO 2.2 Requirements for Processes in Trading Business ...................................................................................................................................................................................90
BTO 2.2.1 Trading.................................................................................................................................................................................................................................................................90
BTO 2.2.2 Settlement and Control............................................................................................................................................................................................................................92
BTO 2.2.3 Representation in Risk Controlling ..................................................................................................................................................................................................................95
BTO 3 Real Estate Business ...........................................................................................................................................................................................................................................................96
BTO 3.1 Structural Organization..................................................................................................................................................................................................................................................96
BTO 3.2 Requirements for Processes in Real Estate Business.............................................................................................................................................................................97
BTO 3.2.1 Acquisition or Construction of Real Estate .........................................................................................................................................................................................................98
BTO 3.2.2 Further Processing and Monitoring ....................................................................................................................................................................................................98
BTO 3.2.3 Processing Controls.................................................................................................................................................................................................................................99
BTR Requirements for Risk Steering and Controlling Processes........................................................................................................................................................................... 100
BTR 1 Counterparty Default Risks..................................................................................................................................................................................................................................................... 101
BTR 2 Market Price Risks .............................................................................................................................................................................................................................................................. 103
BTR 2.1 General Requirements................................................................................................................................................................................................................................. 103
BTR 2.2 Market Price Risks of the Trading Book ............................................................................................................................................................................................................. 104
BTR 2.3 Market Price Risks of the Banking Book (including Interest Rate Risks) ....................................................................................................................................... 104
BTR 3 Liquidity Risks............................................................................................................................................................................................................................................................... 108
BTR 3.1 General Requirements................................................................................................................................................................................................................................. 108
BTR 3.2 Additional Requirements for Capital Market-Oriented Institutions ............................................................................................................................................................ 111

Federal Financial Supervisory Authority (BaFin)
Annex 2: MaRisk of 29.05.2024 – All Changes Compared to the MaRisk Version of 29.06.2023

BTR 4 Operational Risks ...................................................................................................................................................................................................................................................... 113
BTR 5 Credit Spread Risks in the Banking Book ........................................................................................................................................................................................................................... 115
BT 2 Special Requirements for the Design of Internal Audit .................................................................................................................................................................. 116
BT 2.1 Tasks of Internal Audit ................................................................................................................................................................................................................................. 116
BT 2.2 Principles for Internal Audit .......................................................................................................................................................................................................................... 117
BT 2.3 Audit Planning and Execution....................................................................................................................................................................................................................... 118
BT 2.4 Reporting Obligation ................................................................................................................................................................................................................................................................... 119
BT 2.5 Reaction to Identified Deficiencies ............................................................................................................................................................................................................................. 121
BT 3 Requirements for Risk Reporting .................................................................................................................................................................................................................. 122
BT 3.1 General Requirements for Risk Reports ................................................................................................................................................................................................ 122
BT 3.2 Reports from the Risk Controlling Function .................................................................................................................................................................................................................. 124
AT 1 Preamble ...................................................................................................................................................................................................................................................................................5
AT 2 Scope of Application ........................................................................................................................................................................................................................................................................8
AT 2.1 Target Group.......................................................................................................................................................................................................................................................................9
AT 2.2 Risks....................................................................................................................................................................................................................................................................................10
AT 2.3 Transactions ..............................................................................................................................................................................................................................................................................11
AT 3 Overall Responsibility of the Management Board .........................................................................................................................................................................................................................14
AT 4 General Requirements for Risk Management ....................................................................................................................................................................................................15
AT 4.1 Risk Capacity .............................................................................................................................................................................................................................................................15
AT 4.2 Strategies..............................................................................................................................................................................................................................................................................19
AT 4.3 Internal Control System .................................................................................