ProAuditMap

MaRisk 2026 for small institutions: what changes for internal audit.

The ninth amendment of the German MaRisk is more principles-based and defines size classes for the first time. For internal audit in small institutions it brings relief, but also tighter conditions.

As of 22 October 2026

Summary

The German Minimum Requirements for Risk Management (MaRisk) of 30 June 2026 distinguish small and very small institutions. Internal audit by a managing director is now only provided for very small institutions and with measures against conflicts of interest, and full outsourcing of internal audit is possible for very small institutions. Non-material activities have to be audited at least every five years, and reporting is at least quarterly. Additional requirements apply after a transition period ending on 1 January 2027.

Fewer explanations, no lowering of the level

The new version entered into force on 30 June 2026 with its publication. According to BaFin, the circular was made more principles-based and explanations were removed to give institutions more discretion in applying it proportionately. This expressly does not lower the overall level of requirements [2].

Where the new version results in additional requirements in individual cases, a transition period until 1 January 2027 applies [2].

Who is small, who is very small

AT 1 para. 3 defines two size classes for the first time. Small institutions are institutions classified as small and non-complex institutions (SNCI) under Article 4(1) point 145 CRR, as well as third-country CRD branches of risk class 2. Very small institutions are institutions and third-country CRD branches whose total assets do not exceed EUR 1 billion on a four-year average; factoring institutions must in addition not exceed an annual receivables purchase volume of EUR 5 billion on a four-year average. They can use the relief for small institutions even if they do not meet the SNCI criteria [1].

The relief applies only where a section expressly provides for it. The general proportionality principle remains in place and can, in individual cases, also require arrangements going beyond the MaRisk [1].

Internal audit by a managing director: narrower than before

Under AT 4.4.3 para. 1, in very small institutions the tasks of internal audit can be taken on by a managing director if a separate audit unit would be disproportionate and measures to avoid conflicts of interest are in place [1].

The 2024 version linked this in AT 4.4.3 para. 1 to the size of the business alone, without a size class [3]. Institutions using this solution should check whether their total assets do not exceed EUR 1 billion on a four-year average and whether the measures against conflicts of interest are documented.

Outsourcing internal audit

AT 9 para. 5 continues to allow full outsourcing of internal audit for non-material subsidiary institutions within a group, and further for very small institutions [1]. In 2024, outside groups it was possible only for small institutions where a separate audit function did not seem appropriate given their size and business [3].

Even with full outsourcing, responsibility remains with the institution. Audit plan, reports and follow-up have to meet the requirements of AT 4.4.3, whoever performs the audits (AT 9 paras. 4 and 10) [1].

Audit plan and cycle: a new five-year limit

Internal audit works on the basis of a comprehensive, risk-oriented audit plan that is updated annually and approved by management. All activities, including outsourced ones, are in principle to be audited within three years, and in a shorter cycle where special risks exist (AT 4.4.3 para. 6) [1].

New is the limit for non-material activities and processes: they have to be included in audit planning and audited within five years [1]. Under the 2024 version, the three-year cycle could be departed from for them without a fixed upper limit, and special risks required annual audits (BT 2.3 para. 1) [3].

Reporting every quarter

Under AT 4.4.3 para. 9, internal audit presents a report to management at least quarterly: with the audits and material deficiencies of the quarter, the measures and their status, all material deficiencies from earlier quarters still open, and an assessment of whether the audit plan is likely to be met [1]. The 2024 version already required a quarterly report (BT 2.4 para. 4), but material deficiencies still open belonged in the annual report [3]. If material deficiencies are not remedied within a reasonable time, the head of internal audit first informs the responsible members of management in writing; if they persist, the entire management body is informed in the next quarterly report at the latest (para. 12) [1].

How a robust follow-up process can be derived from this is described in our article tracking audit findings. Audits still have to be documented with traceable working papers, and reports and working papers kept for six years (para. 10) [1].

Checklist for the head of internal audit before 1 January 2027

For small and very small institutions, the changes lead to these review points:

  1. Determine and document the size class: SNCI under the CRR or total assets up to EUR 1 billion on a four-year average.
  2. If a managing director performs internal audit: justify the disproportionality and record the measures against conflicts of interest.
  3. If internal audit is outsourced: check whether the conditions of AT 9 para. 5 in the new version are met.
  4. Go through the audit universe: is every non-material activity planned in the fifth year at the latest?
  5. Set up the quarterly report: audits and deficiencies of the quarter, all open material deficiencies, status of plan completion.
  6. Compare explanations on which internal procedures relied with the new version and document your own interpretation.

Whether an institution also falls under NIS2 is shown by our free NIS2 and DORA scope check. The framework for planning next year is described in the article audit planning 2027 under NIS2 and DORA, and sample audit programs are freely available: sample audit programs.

NIS2 and DORA scope check

Sources (retrieved on 22 October 2026)

  1. BaFin, Circular 06/2026 (BA), MaRisk of 30 June 2026, AT 1 para. 3, AT 4.4.3, AT 9 paras. 4, 5 and 10 (German): https://www.bundesbank.de/resource/blob/825336/866a68577eb35afee82fbe60c39a4f87/472B63F073F071307366337C94F8C870/2026-06-30-rundschreiben-data.pdf
  2. BaFin, cover letter to MaRisk of 30 June 2026, entry into force and transition period (German): https://www.bundesbank.de/resource/blob/817668/a01783da8a8eb23ba9fe333001d85c41/472B63F073F071307366337C94F8C870/2026-06-30-anschreiben-data.pdf
  3. BaFin, Circular 06/2024 (BA), MaRisk of 29 May 2024, AT 4.4.3, AT 9 para. 5, BT 2.3, BT 2.4 (German, comparison): https://www.bundesbank.de/resource/blob/932738/fa6ddd3636c40c9f9d5cb4fad4f07121/472B63F073F071307366337C94F8C870/2024-05-29-rundschreiben-data.pdf

This article gives an overview and is not legal advice. The wording of the circular is authoritative.