Germany's Federal Financial Supervisory Authority (BaFin) issued a dedicated risk-management rulebook today (Monday) for small and midsized investment firms. The standards take effect on Jan. 1, 2027.
For retail trading companies, the scope reaches firms that execute client orders, deal in derivatives or hold client money. German entities operated by CFD and FX groups may fall within the framework, while brokers licensed as banks remain under separate banking standards.
The WpI MaRisk circular replaces the analogous use of bank-focused MaRisk for the two smaller categories of investment firm. BaFin said the separate framework is intended to provide greater legal clarity and account for operating models that differ from those of credit institutions.
Customer Losses and Platform Failures Enter the Risk Map
Covered firms must identify material risks across their operations, including risks to customers, markets and the firm itself.
Information and communications technology risks must be included explicitly. Environmental, social and governance factors are treated as possible drivers of other risks.
BaFin's customer-risk category includes unsuitable or inadequate investment advice, failed control procedures, trading and valuation errors and actions by tied agents.
- Unlicensed FX and CFDs Brokers Multiply in Germany as BaFin Issues Sharp Warning
- BaFin Puts Brokers on Notice as Report Links Finfluencers to Risky Crypto Trading
- N26 Appoints UBS Executive Mike Dargan as CEO amid Fresh BaFin Restrictions
System and process outages also appear on the list. Firms that do not segregate client money must account for that structure in their customer-risk assessment.
The perimeter is relevant to groups with German investment-firm entities. IG Europe operates under BaFin supervision.
CMC Markets Germany has expanded into German certificates. The circular does not identify affected companies, and FinanceMagnates.com could not confirm either firm's current classification from public BaFin material.
Trading Books Face Daily Controls
Investment firms must separate trading from risk management, settlement and control functions through the management level. An exception applies where trading activity is small and not complex.
Trades must be monitored continuously. Firms must investigate discrepancies promptly and record positions in risk systems without delay.
Medium firms face more detailed controls when losses from their positions are material. They must establish counterparty, issuer and market-price risk limits, monitor their use and document breaches and remedial measures.
Trading-book positions must be valued daily and combined into an overall risk position at least once each day. Positions in the investment book that carry market-price risk require valuation at least quarterly, with more frequent checks where the activity warrants them.
Capital Plans Must Include an Adverse Scenario
Small and medium firms must prepare a multiyear capital plan tied to their operations and risk management. The plan must include the expected case and at least one adverse scenario.
Every covered firm needs a compliance function. A separate risk-management function and internal audit are required where proportionate to the size and complexity of its operations.
The rules also require contingency planning for critical or important functions. Outsourcing arrangements must sit in a central management framework with a complete register, ongoing service-quality reviews and controls covering subcontracting chains.
Medium firms must estimate how long an orderly wind-down would take and what it would cost. The assessment must be more detailed where the firm takes ownership or possession of customer cash or securities.
CFD Dealers May Fall Outside the Smallest Category
Under the European Union's Investment Firms Regulation, an investment firm qualifies as small and non-interconnected only if it meets every condition in Article 12. The test is cumulative.
Among other conditions, client money and safeguarded client assets must both be zero. Measures tied to trading flow and own-account market risk must also be zero.
Those conditions mean a CFD dealer that holds client money or takes market risk cannot use the small-firm classification. It may instead fall into the medium category unless it meets the separate conditions that place systemically important investment firms under bank capital rules.
The European Banking Authority describes the IFD and IFR framework as a proportional alternative to banking regulation for firms whose risks are not captured well by bank rules. Its scope covers activities including order transmission, portfolio management and trading on own account.
Until the new circular takes effect, small and medium German investment firms continue to apply bank MaRisk. They may take account of changes introduced by the ninth MaRisk amendment during the transition, while large investment firms will remain under the bank framework after Jan. 1.