MaRisk and DORA: the interfaces of the 9th MaRisk amendment

This page applies to both frameworks: to credit institutions under the full framework of Articles 5 to 15 DORA, which have applied DORA since 17 January 2025, and to the institutions under Section 1a(2a) of the German Banking Act (KWG) (here: the KWG group), which apply the simplified framework under Article 16 from 1 January 2027. For insurers, the MaGo (BaFin’s minimum requirements for the system of governance of insurers) apply instead of the MaRisk (DORA for insurers), and for fund management companies the KAMaRisk (their minimum requirements for risk management).

Where does MaRisk 2026 touch DORA?

In several places. BaFin published the 9th amendment on 30 June 2026 as Circular 06/2026 (BA) and describes it as more principles-based, with further relief for small and very small institutions. For DORA users, these points matter most:

• AT 2.2: ICT risks are part of operational risk and must be explicitly included in the risk inventory.
• AT 4.2: The management board sets an ICT strategy, which may be combined with a digital operational resilience strategy (DOR strategy) in one document.
• AT 4.4.2: The compliance function may be combined with the ICT risk control function under Article 6(4) DORA (explanatory note to paragraph (Tz.) 3). Details on the control function are on the page ICT risk management.
• AT 7.3: The emergency concept builds on the DORA term “critical or important functions”.
• AT 8.2: Before material changes to organisation and ICT systems, the effects on controls must be analysed, including for the DORA implementation.
• AT 9: ICT services subject to Articles 28 to 30 DORA fall outside the scope of AT 9.

This page describes version 06/2026. It does not compare it with earlier versions.

Who is subject to the MaRisk alongside DORA?

All institutions under Section 1(1b) KWG that are not directly supervised by the ECB (AT 2.1 Tz. 1), but financial services institutions only in part:

Which DORA framework applies to an institution is explained on the page DORA applicability, what needs to be done under the Article 16 framework on the page DORA Article 16.

AT 4.2: What do the MaRisk require for the ICT strategy?

An ICT strategy that fits the business strategy. AT 4.2 Tz. 2 requires: “The management board must set a sustainable ICT strategy that is consistent with the business strategy.” (Quotations from the MaRisk on this page are our translation.) If an institution is required to have a DOR strategy, the ICT strategy and the DOR strategy may, depending on size and overall risk profile, be set out in a joint document (Tz. 2) or integrated into the business strategy (Tz. 4). What the DOR strategy must contain under the full framework and how it relates to the IT strategy is explained on the page ICT risk management.

For financial services institutions, AT 4.2 is not among the modules expressly named in AT 2.1 Tz. 2, so an ICT strategy is not a certain obligation for them. What applies to the IT strategy under the Article 16 framework is on the page DORA Article 16.

AT 2.2: How does ICT risk get into the risk inventory?

As part of operational risk, which the MaRisk generally classify as material. The explanatory note to AT 2.2 says: “Information and communication technology risks (ICT risks) are a component of operational risk and must be explicitly included in the risk inventory.” The risk inventory gives the management board a regular and ad hoc overview of the overall risk profile (AT 2.2 Tz. 1).

The assessment of the ICT risks themselves takes place within the DORA framework: under the full framework in the ICT risk management framework under Article 6, under the Article 16 framework in the regular, documented ICT risk assessment under RTS 2024/1774 Article 31. Both require risk tolerance thresholds in line with the institution’s risk appetite (Article 6(8)(b) DORA, RTS Article 31(1)(a)). The interface therefore lies in the risk appetite that the management board sets for all material risks under AT 4.2 Tz. 2: the ICT tolerance thresholds are derived from it, and the results of the ICT risk assessment feed back into the inventory.

AT 7.3: emergency concept and DORA business continuity

Both apply, and they use the same term. AT 7.3 Tz. 1 requires: “For activities and processes that constitute critical or important functions, provision must be made through an emergency concept.” For financial services institutions, AT 2.1 Tz. 2 expressly highlights module AT 7, under the Article 16 framework as well. Like the rest of the MaRisk, it applies to them to the extent required by size and business. The supervisory notice of 21 August 2025 no longer provides for an emergency concept under the simplified framework, but sector requirements on emergency management continue to apply.

Our recommendation: AT 7.3 leads on the emergency concept for the institution as a whole, DORA on the ICT part. Article 11(1) DORA expressly allows the ICT business continuity policy to be adopted as part of the overall business continuity policy. Both sides work with one list of functions and one BIA, and the quarterly report under AT 7.3 contains the results of the ICT tests.

AT 9 and Articles 28 to 30: which rule applies to which provider?

DORA for ICT services, AT 9 for all other outsourcing. The explanatory note to AT 9 Tz. 1 reads: “Outsourced or externally procured ICT services within the meaning of Article 3(21) DORA that are subject to ICT third-party risk management under Articles 28-30 DORA do not fall within the scope of AT 9.” What matters for the assignment is the term “subject to”:

A material outsourcing under AT 9 is not the same as a service supporting a critical or important function. The distinction with examples is on the page critical or important functions.

The organisation overlaps as well: depending on the nature, scale and complexity of the outsourcing, AT 9 Tz. 12 requires central outsourcing management with a complete outsourcing register. Under the full framework, Article 5(3) DORA requires institutions that are not microenterprises to establish a role to monitor the arrangements with ICT third-party service providers, which BaFin compares with the (central) outsourcing officer. Under the Article 16 framework, no such role is required. According to BaFin, for intra-group ICT services the waiver of exit strategies and alternative courses of action that AT 9 Tz. 14(d) MaRisk 06/2026 provides for intra-group and intra-network outsourcing does not apply. How to manage your ICT providers under Articles 28 to 30 is on the page managing ICT third-party service providers, the register under Article 28(3) on the page register of information.

AT 8.2: Is the DORA implementation a material change?

You have to check. Before material changes to the organisational structure and processes and to ICT systems, AT 8.2 Tz. 1 requires an analysis of the effects on control procedures and control intensity, involving the risk control function, the compliance function and internal audit. In its FAQ, BaFin recommends checking in a materiality analysis, depending on the scope of the DORA adjustments, whether the conditions of AT 8.2 are met.

In day-to-day operations the rules complement each other: change management under DORA covers every change to ICT systems (full framework RTS Article 17, Article 16 framework RTS Article 38). AT 8.2 comes in addition for material changes and asks about the consequences for the controls. In practice this means a mandatory question “material within the meaning of AT 8.2?” in the change request, with defined criteria.

Interface matrix: who leads, who refers

Entirely fictitious example, not a client: Musterbank AG is a regional bank with 180 employees, a CRR credit institution without direct ECB supervision. It applies the MaRisk in full, and DORA under the full framework since 17 January 2025. It obtains its core banking system as a service from a data centre, and an audit firm handles parts of internal audit. In November 2026 it decides which rule leads at each interface and which document serves the other rule. The last column shows what is different for this website’s model institution: Muster-Factoring GmbH with 23 employees and total assets of EUR 61 million, so not a microenterprise, which applies Article 16 from 1 January 2027.

Interface matrix MaRisk ↔ DORA (template, completed with fictitious data, as of 6 November 2026):

The column “Who leads, who refers” is our recommendation for consistent documentation and not a supervisory requirement. Where Musterbank follows two rulebooks in one document, the document cites both references.

Three typical gaps

Example, matrix and gaps are our professional assessment based on the wording of the MaRisk, DORA, the RTS and BaFin’s supervisory notices.

How we can help

Credit institutions under the full framework start with the DORA gap analysis: it shows where MaRisk documents and DORA evidence diverge and ends with an action plan. Institutions of the KWG group moving from BAIT on 1 January 2027 find the integration with the MaRisk in our service for the transition from BAIT to Article 16.