MaRisk, BAIT and DORA: what now applies to German institutions

Short answer: Since 30 June 2026, German institutions have been subject to the new MaRisk (BaFin Circular 06/2026 (BA)); additional requirements are due by 1 January 2027. DORA has governed ICT risk directly since 17 January 2025. The BAIT are being phased out: BaFin repeals them in full at the end of 31 December 2026.

This overview is for heads of compliance, heads of legal, outsourcing managers and information security officers at banks and financial services institutions in Germany. It explains how MaRisk, BAIT and DORA fit together today, which deadlines run and what capacity the transition requires.

What are MaRisk, BAIT and DORA?

MaRisk, BAIT and DORA jointly govern risk management at German institutions, but with different legal status and scope. Since 2025 the weight has shifted from the national circular to the EU regulation.

• MaRisk: BaFin's Minimum Requirements for Risk Management specify Section 25a(1) of the German Banking Act (KWG) and Section 25b KWG on outsourcing (AT 1 para. 1). According to BaFin, the 9th amendment (Circular 06/2026 (BA) of 30 June 2026) is more principles-based and less complex; explanatory notes were removed, but BaFin's cover letter states that the overall level of requirements has not been lowered.
• BAIT: the Supervisory Requirements for IT in Financial Institutions (Circular 10/2017 (BA), last amended on 16 December 2024) set out IT requirements. They are being repealed in stages.
• DORA: Regulation (EU) 2022/2554 governs ICT risk management, incident reporting, resilience testing and ICT third-party risk directly across the EU (Art. 64).

The new MaRisk explicitly draws a line with DORA: ICT services within the meaning of Art. 3(21) DORA that are subject to ICT third-party risk management under Articles 28 to 30 DORA fall outside the outsourcing module AT 9 (AT 9 para. 1, explanatory note). The amendment also incorporates BaFin's supervisory communication of 26 November 2024 into the text.

Who is affected?

MaRisk applies to institutions under Section 1(1b) and Section 53(1) KWG unless they are significant institutions directly supervised by the ECB, and to CRD third-country branches (AT 2.1 para. 1). Which IT rules apply depends on whether and when an institution falls under DORA.

Smaller entities covered by Art. 16 DORA apply a simplified ICT risk management framework. BaFin published a dedicated supervisory communication on this on 21 August 2025.

Deadlines and current status

The transition ends in late 2026, when the BAIT expire and the transitional period of the new MaRisk runs out.

The transitional period to 1 January 2027 also applies where an institution had documented a different reading of the 26 November 2024 supervisory communication and now needs to adjust its organisation.

What institutions need to do now

By year-end, institutions should restructure their rulebook around the new order: DORA for ICT, MaRisk for the rest of risk management, BAIT only as a legacy framework.

1. MaRisk 06/2026 gap analysis: identify requirements that are new or changed compared with the 2023 version, implement them by 1 January 2027 and update paragraph references in policies.
2. Replace BAIT references: move written policies, IT strategy and controls onto DORA and its technical standards; for financial services institutions the cut-off date is 1 January 2027.
3. Separate outsourcing from ICT third parties: decide per service whether AT 9 MaRisk or Art. 28–30 DORA applies, and reconcile the outsourcing register with the register of information.
4. Update contracts: check ICT contracts against the key contractual provisions in Art. 30 DORA; continue to assess non-DORA outsourcing contracts against AT 9.
5. Clarify functions: define the set-up of the compliance function, the ICT risk control function, the money laundering reporting officer and the data protection officer; MaRisk allows the compliance function to be combined with the ICT risk control function under Art. 6(4) DORA (AT 4.4.2 para. 3, explanatory note).
6. Run reporting and registers: prepare DORA incident reporting (Art. 19) and the register of information with a 31 December reference date for submission by 31 March.

Which roles and capacity you need

The transition is mainly rulebook, contract and documentation work. It hits compliance, legal, outsourcing management and information security at the same time.

Capacity peaks mainly in the fourth quarter, when the end of the BAIT, the end of the MaRisk transitional period and preparation of the register of information coincide.

How interim support helps

Interim professionals bridge the gap between the year-end peak and the base load without creating permanent headcount. Alpinum Solutions, the leading provider of interim legal & compliance in Germany, provides compliance officers, regulatory specialists and project lawyers through Arbeitnehmerüberlassung (German temporary agency work, or staff leasing) and freelancing – part-time or full-time (20–100%), as individuals or teams, from junior to senior. Alpinum Solutions GmbH holds a licence for temporary agency work from the Hesse Regional Directorate of the Federal Employment Agency.

• Staff leasing: the institution holds the right to issue professional instructions; the professional is integrated into its organisation.
• Freelancing: the professional works independently within the agreed mandate, for example on a defined gap analysis.

Selected profiles are usually available within 48 hours; the institution and Alpinum agree the start date together.

Limits and risks

Overall responsibility stays with the management board (AT 3.1 MaRisk), and ultimate responsibility for ICT risk lies with the management body (Art. 5(2)(a) DORA). Whether an assignment amounts to outsourcing in an individual case is for the institution to assess and document. Interim professionals work to the institution's instructions and replace neither auditors nor internal audit.

Frequently asked questions on MaRisk, BAIT and DORA

Do the BAIT still apply?

Only on a transitional basis and only for institutions not yet subject to DORA. Institutions applying DORA since 17 January 2025 left the BAIT scope at the end of 16 January 2025. BaFin repeals the BAIT in full at the end of 31 December 2026; from then on, DORA governs ICT risk.

Which MaRisk version currently applies?

Circular 06/2026 (BA), the 9th amendment, has applied since 30 June 2026. It entered into force on publication. Where it creates additional requirements, BaFin grants a transitional period until 1 January 2027. The amendment is more principles-based and incorporates the supervisory communication of 26 November 2024 into the text.

Does AT 9 MaRisk still apply to IT service providers?

Not for ICT services under Art. 3(21) DORA that are subject to ICT third-party risk management under Articles 28 to 30 DORA. These are expressly excluded from AT 9. For other outsourcing, such as business processes without an ICT element, the risk analysis and contractual requirements of AT 9 continue to apply.

Does MaRisk apply to significant institutions?

No. Under AT 2.1 para. 1, MaRisk addresses institutions under Section 1(1b) and Section 53(1) KWG unless they are classified as significant institutions under the SSM Regulation and directly supervised by the ECB. DORA, by contrast, applies regardless of this classification, so significant institutions are also covered.

Does this apply to Swiss banks?

No. MaRisk, BAIT and DORA are German and EU law. Swiss banks are supervised by FINMA; operational resilience is governed by FINMA Circular 2023/1. Swiss groups with institutions in Germany need to meet both frameworks in parallel.

Next step

Tell us the scope, deadlines and bottlenecks of your MaRisk and DORA project. We will show you suitable profiles or a team set-up.

• Regulatory compliance and regulatory change
• Regulatory radar: deadlines and obligations at a glance
• DORA: legal and compliance workstreams
• Implementing FINMA Circular 2023/1
• Discuss your requirements

Last updated: 10 November 2026.