When must a MaRisk outsourcing review be carried out?

MaRisk AT 9 requires a prior risk analysis before every material outsourcing, plus regular follow-up reviews — typically annually for IT outsourcing.

All terms

Topic: Recht & Aufsicht

What is MaRisk?

MaRisk (Mindestanforderungen an das Risikomanagement) is a BaFin circular setting out the requirements for internal risk management at German banks and financial services providers — binding in substance since 2005, with regular amendments.

MaRisk comprises seven modules: AT (general part), BT 1 (internal control system), BT 2 (internal audit), BT 3 (risk types), BTO (risk management in lending), BTR (risk types in detail) and BTL (liquidity risks). Outsourcing is governed by AT 9.

MaRisk mandates require consultancies with documented hands-on experience in the relevant module structure. Senior profiles with 5+ years of banking background are usually a prerequisite.

Frequently asked

When must a MaRisk outsourcing review be carried out?: MaRisk AT 9 requires a prior risk analysis before every material outsourcing, plus regular follow-up reviews — typically annually for IT outsourcing.

Related terms

BaFinBaFin (Bundesanstalt für Finanzdienstleistungsaufsicht) is the German supervisory authority for banks, insurers, securities trading and payment services — based in Bonn and Frankfurt am Main, founded in 2002.
BAITBAIT (Bankaufsichtliche Anforderungen an die IT) is a BaFin circular from 2017 (amended in 2021 and 2024) that specifies IT requirements for banks and financial services providers — complementing MaRisk AT 7.

Last updated: 2026-05-05