Circular 06/2026 (BA) Minimum Requirements for Risk Management (MaRisk) - Explanations as of June 30, 2026

Rundschreiben 06/2026 (BA) Minimum Requirements for Risk Management - MaRisk Explanations as of: 30.06.2026

Table of Contents AT 1 Objective of the Circular 6 AT 2 Scope of Application 14 AT 2.1 User Group 15 AT 2.2 Risks 16 AT 2.3 Transactions 18 AT 3 Responsibility of the Management Board and the Supervisory Body 20 AT 3.1 Overall Responsibility of the Management Board 20 AT 3.2 Responsibility of the Supervisory Body and its Committees 21 AT 4 General Requirements for Risk Management 21 AT 4.1 Risk-bearing Capacity 22 AT 4.2 Strategies 30 AT 4.3 Internal Control System 32 AT 4.3.1 Organizational Structure and Processes 32

AT 4.3.2 Risk Management and Controlling Processes 32 AT 4.3.3 Stress Tests 34 AT 4.3.4 Use of Models 36 AT 4.4 Special Functions 43 AT 4.4.1 Risk Controlling Function 43 AT 4.4.2 Compliance Function 46 AT 4.4.3 Internal Audit 48 AT 5 Organizational Guidelines 53 AT 6 Documentation 55 AT 7 Resources 55 AT 7.1 Personnel 56 AT 7.2 Technical and Organizational Equipment 56 AT 7.3 Emergency Management 58 AT 8 Adaptation Processes 60 AT 8.1 New Product Process 60 AT 8.2 Changes to Operational Processes or Structures; Acquisitions and Mergers 62

AT 9 Outsourcing 63 BT 1 Special Requirements for the Internal Control System 73 BTO Requirements for Organizational Structure and Processes 73 BTO 1 Lending Business 76 BTO 1.1 Segregation of Duties and Approval 76 BTO 1.2 Requirements for Processes in the Lending Business 82 BTO 1.2.1 Loan Origination 88 BTO 1.2.2 Loan Servicing 91 BTO 1.2.3 Loan Processing Control 92 BTO 1.2.4 Intensive Care 93 BTO 1.2.5 Treatment of Non-Performing Loans 93 BTO 1.2.6 Risk Provisioning 96 BTO 1.3 Requirements for Early Warning Systems for Risks and Treatment of Forbearance 97 BTO 1.3.1 Early Warning Systems for Risks 97 BTO 1.3.2 Treatment of Forbearance 98 BTO 1.4 Risk Classification Procedures 100 BTO 2 Trading Business 101

BTO 2.1 Segregation of Duties 101 BTO 2.2 Requirements for Processes in the Trading Business 102 BTO 2.2.1 Trading 102 BTO 2.2.2 Settlement and Control 105 BTO 2.2.3 Mapping in Risk Controlling 108 BTO 3 Real Estate Business 110 BTO 3.1 Organizational Structure 110 BTO 3.2 Requirements for Processes in the Real Estate Business 111 BTO 3.2.1 Real Estate Acquisition or Construction 112 BTO 3.2.2 Servicing and Monitoring 113 BTR Requirements for Risk Management and Controlling Processes 114 BTR 1 Counterparty Credit Risks 115 BTR 2 Market Price Risks 118 BTR 2.1 General Requirements 119 BTR 2.2 Market Price Risks of the Trading Book 119 BTR 2.3 Market Price Risks of the Banking Book (including Interest Rate Risks) 120

BTR 3 Liquidity Risks 128 BTR 4 Operational Risks 130 BTR 5 Credit Spread Risks in the Banking Book 132 BT 2 Requirements for Risk Reporting 134 BT 2.1 General Requirements for Risk Reports 134 BT 2.2 Reports of the Risk Controlling Function 135 List of Abbreviations 139 Circular 06/2024 29.05.2024

Appendix 1: MaRisk of 29.05.2024 – Text and Explanations Contents AT 1 Preamble 5 AT 2 Scope of Application 8 AT 2.1 User Group ................................................................................................................................................................................................................................................................................... 9 AT 2.2 Risks ................................................................................................................................................................................................................................................................................................ 10 AT 2.3 Transactions .......................................................................................................................................................................................................................................................................................... 11 AT 3 Overall Responsibility of the Management Board 14 AT 4 General Requirements for Risk Management 15 AT 4.1 Risk-bearing Capacity ......................................................................................................................................................................................................................................................................... 15 AT 4.2 Strategies .......................................................................................................................................................................................................................................................................................... 19 AT 4.3 Internal Control System .............................................................................................................................................................................................................................................................. 23 AT 4.3.1 Organizational Structure and Processes .................................................................................................................................................................................................................... 23 AT 4.3.2 Risk Management and Controlling Processes ............................................................................................................................................................................................................. 24 AT 4.3.3 Stress Tests ............................................................................................................................................................................................................................................................................... 25 AT 4.3.4 Data Management, Data Quality and Aggregation of Risk Data ........................................................................................................................................................... 27 AT 4.3.5 Use of Models ............................................................................................................................................................................................................................................................. 29 AT 4.4 Special Functions ................................................................................................................................................................................................................................................................. 31 AT 4.4.1 Risk Controlling Function .................................................................................................................................................................f.............................................................................. 31 AT 4.4.2 Compliance Function ......................................................................................................................................................................................................................................................... 33 AT 4.4.3 Internal Audit ................................................................................................................................................................................................................................................................... 34 AT 4.5 Risk Management at Group Level ................................................................................................................................................................................................................................. 36 AT 5 Organizational Guidelines 38

Federal Financial Supervisory Authority (BaFin) Appendix 1: MaRisk of 29.05.2024 – Text and Explanations BA 54 - MaRisk of 30.06.2026 Federal Financial Supervisory Authority (Bafin) Page 8 of 149 AT 6 Documentation 39 AT 7 Resources 40 AT 7.1 Personnel............................................................................................................................................................................................................................................................................................. 40 AT 7.2 Technical and Organizational Equipment .............................................................................................................................................................................................................................. 41 AT 7.3 Emergency Management ..................................................................................................................................................................................................................................................... 43 AT 8 Adaptation Processes 45 AT 8.1 New Product Process .................................................................................................................................................................................................................................................................... 45 AT 8.2 Changes to Operational Processes or Structures ........................................................................................................................................................................................................ 47 AT 8.3 Acquisitions and Mergers ....................................................................................................................................................................................................................................................... 48 AT 9 Outsourcing 49 BT 1 Special Requirements for the Internal Control System 58 BTO Requirements for Organizational Structure and Processes 59 BTO 1 Lending Business ..................................................................................................................................................................................................................................................................................62 BTO 1.1 Segregation of Duties and Approval ................................................................................................................................................................................................................................ 62 BTO 1.2 Requirements for Processes in the Lending Business ................................................................................................................................................................................................. 67 BTO 1.2.1 Loan Origination ........................................................................................................................................................................................................................................................ 73 BTO 1.2.2 Loan Servicing .......................................................................................................................................................................................................................................................... 75 BTO 1.2.3 Loan Processing Control .......................................................................................................................................................................................................................................... 77 BTO 1.2.4 Intensive Care ...................................................................................................................................................................................................................................................... 77 BTO 1.2.5 Treatment of Non-Performing Loans ........................................................................................................................................................................................................................78

Federal Financial Supervisory Authority (BaFin) Appendix 1: MaRisk of 29.05.2024 – Text and Explanations BA 54 - MaRisk of 30.06.2026 Federal Financial Supervisory Authority (Bafin) Page 9 of 149 BTO 1.2.6 Risk Provisioning ............................................................................................................................................................................................................................................................. 80 BTO 1.3 Requirements for Early Warning Systems for Risks and Treatment of Forbearance ........................................................................................................ 81 BTO 1.3.1 Early Warning Systems for Risks ......................................................................................................................................................................................................................... 81 BTO 1.3.2 Treatment of Forbearance ................................................................................................................................................................................................................................ 82 BTO 1.4 Risk Classification Procedures ...................................................................................................................................................................................................................................... 84 BTO 2 Trading Business ............................................................................................................................................................................................................................................................................. 85 BTO 2.1 Segregation of Duties.............................................................................................................................................................................................................................................................. 85 BTO 2.2 Requirements for Processes in the Trading Business............................................................................................................................................................................................. 86 BTO 2.2.1 Trading ............................................................................................................................................................................................................................................................................ 86 BTO 2.2.2 Settlement and Control ..................................................................................................................................................................................................................................... 88 BTO 2.2.3 Mapping in Risk Controlling .............................................................................................................................................................................................................................91 BTO 3 Real Estate Business ......................................................................................................................................................................................................................................................................92 BTO 3.1 Organizational Structure ............................................................................................................................................................................................................................................................ 92 BTO 3.2 Requirements for Processes in the Real Estate Business ...................................................................................................................................................................................... 93 BTO 3.2.1 Real Estate Acquisition or Construction ................................................................................................................................................................................................................... 94 BTO 3.2.2 Servicing and Monitoring .............................................................................................................................................................................................................................................. 94 BTO 3.2.3 Processing Controls .......................................................................................................................................................................................................................................... 95 BTR Requirements for Risk Management and Controlling Processes 96 BTR 1 Counterparty Credit Risks .................................................................................................................................................................................................................................................................. 97 BTR 2 Market Price Risks ........................................................................................................................................................................................................................................................................... 99 BTR 2.1 General Requirements .............................................................................................................................................................................................................................................................. 99 BTR 2.2 Market Price Risks of the Trading Book ........................................................................................................................................................................................................................ 100 BTR 2.3 Market Price Risks of the Banking Book (including Interest Rate Risks) ............................................................................................................................................... 100 BTR 3 Liquidity Risks .......................................................................................................................................................................................................................................................................... 103 BTR 3.1 General Requirements ............................................................................................................................................................................................................................................................ 103 BTR 3.2 Additional Requirements for Capital Market-Oriented Institutions ................................................................................................................................................................... 106 BTR 4 Operational Risks ................................................................................................................................................................................................................................................................. 108 BTR 5 Credit Spread Risks in the Banking Book ....................................................................................................................................................................................................................................... 110

Federal Financial Supervisory Authority (BaFin) Appendix 1: MaRisk of 29.05.2024 – Text and Explanations BA 54 - MaRisk of 30.06.2026 Federal Financial Supervisory Authority (Bafin) Page 10 of 149 BT 2 Special Requirements for the Design of Internal Audit 111 BT 2.1 Tasks of Internal Audit .............................................................................................................................................................................................................................................................. 111 BT 2.2 Principles for Internal Audit ...................................................................................................................................................................................................................................................... 112 BT 2.3 Audit Planning and Execution .................................................................................................................................................................................................................................................. 113 BT 2.4 Reporting Obligation ............................................................................................................................................................................................................................................................... 114 BT 2.5 Response to Identified Deficiencies ......................................................................................................................................................................................................................................... 116 BT 3 Requirements for Risk Reporting 117 BT 3.1 General Requirements for Risk Reports ............................................................................................................................................................................................................................ 117 BT 3.2 Reports of the Risk Controlling Function .............................................................................................................................................................................................................................. 119

Federal Financial Supervisory Authority (BaFin) Appendix 1: MaRisk of 29.05.2024 – Text and Explanations BA 54 - MaRisk of 30.06.2026 Federal Financial Supervisory Authority (Bafin) Page 11 of 149 AT 1 PreambleObjective of the Circular 1 This circular provides a flexible and practical framework for the design of risk management in institutions based on Section 25a (1) of the German Banking Act (KWG). It also specifies the requirements of Section 25a (3) KWG (risk management at group level) and Section 25b KWG (outsourcing). Appropriate and effective risk management, taking into account risk-bearing capacity, includes in particular the definition of strategies and the establishment of internal control procedures. The internal control procedures consist of the internal control system and internal audit. The internal control system includes in particular Section 26c KWG (ESG risks).

• Regulations on organizational structure and processes,
• Processes for identifying, assessing, managing, monitoring and communicating risks (risk management and controlling processes) and
• a risk controlling function and a compliance function. Risk management creates a basis for the proper exercise of the supervisory body's monitoring functions and therefore also includes its appropriate involvement. Branches according to Section 53 KWG Since branches of companies with their registered office abroad according to Section 53 KWG CRD third-country branches Since there is no supervisory body for CRD third-country branches, these institutions must involve their corporate headquarters in an appropriate manner instead. 2 The circular also provides a qualitative framework for the implementationinterpretation