BaFin Amends Audit Regulations for Securities Institutions and Crowdfunding Providers to Align with

Key Takeaways

• BaFin has amended the Securities Institutions Audit Report Regulation and the Crowdfunding Service Providers Audit Regulation, effective September 11, 2026, to align audit requirements with DORA (Regulation (EU) 2022/2554).
• Auditors must now apply these more detailed requirements during annual audits, so compliance teams at affected firms should confirm their ICT risk documentation and evidence are audit-ready.

Deep Dive

BaFin has amended the Securities Institutions Audit Report Regulation and the Crowdfunding Service Providers Audit Regulation to align audit requirements with DORA (Regulation (EU) 2022/2554). Auditors must now apply these more detailed requirements during annual audits, so compliance teams at affected firms should confirm their ICT risk documentation and evidence are audit-ready.

The amending regulation was published in the Federal Law Gazette on September 10, 2026, and took effect on September 11, 2026. It supplements Germany's national implementation of DORA by bringing the audit regulations for securities institutions and crowdfunding service providers into line with existing legislation. Compliance teams should treat this as an update to the audit framework, not a new substantive obligation, because DORA itself has applied since January 2025.

The update's main effect is on how annual audits are conducted. Auditors must consider DORA requirements during annual audits, and the amended regulation further specifies details of the audit process. The press release does not describe the specific new audit procedures, reporting templates, or testing scope. Firms should therefore review the full regulatory text in the Federal Law Gazette to identify the precise changes. We have not verified those details and they should not be assumed.

Because the regulation is already in effect and no transition period is mentioned, it should be assumed to apply to the next annual audit cycle. Compliance teams should take these steps:
- Obtain and review the amended text.
- Perform a gap analysis against current DORA compliance documentation. This should cover ICT risk management, incident reporting, resilience testing, and third-party risk management.
- Brief internal audit and the external auditors on scope and expectations.
- Update audit preparation checklists and evidence repositories.

The risk implications are moderate. Firms that have implemented DORA should face limited disruption. Those with remaining gaps may see them surface as audit findings, which could draw supervisory attention from BaFin and lead to remediation requirements. Early engagement with auditors, and clear ownership of DORA evidence across IT, risk, and compliance functions, will reduce the risk of adverse findings and last-minute audit burdens.

Source: Federal Financial Supervisory Authority