BaFin President Outlines Shift to Faster, More Proportionate, Risk-Based Supervision

Key Takeaways

• BaFin President Mark Branson used a keynote speech to signal a strategic recalibration of German financial supervision toward greater proportionality, simplified rules, and faster, risk-focused intervention, particularly for troubled institutions.
• Compliance teams should note the emphasis on governance and risk culture over pure quantitative metrics, as well as expanded supervisory resources in cybersecurity, AML, conduct supervision, and forensic investigations.
• This signals heightened scrutiny of firms with weak governance structures, dominant management figures, or non-core business activities.

Deep Dive

BaFin's speech signals a deliberate evolution in supervisory philosophy rather than a single discrete rule change, but the implications for compliance functions are substantial. The regulator is explicitly moving away from highly detailed, prescriptive rulebooks toward principle-based requirements, citing a roughly 30 percent reduction in the length of its revised MaRisk guidelines. This grants institutions more flexibility in how they meet requirements, but shifts greater responsibility and interpretive risk onto firms themselves, since BaFin states it will not pre-address every possible interpretation of its rules.

A key theme is BaFin's intensified focus on governance, risk culture, and board oversight failures as root causes of institutional distress, rather than relying solely on quantitative risk-weighted asset calculations. The speech cites real-world failure patterns—dominant unchallenged executives, inadequate separation of market and back-office functions, and supervisory boards lacking sufficient expertise or time—as warning signs BaFin will scrutinize going forward. Compliance and risk teams should expect increased supervisory attention to governance structures, board composition, and internal control separation, not just capital and liquidity metrics.

Operationally, BaFin is reallocating (not necessarily growing) resources toward cybersecurity, money laundering prevention, conduct-of-business supervision in investment product distribution, and forensic investigations. The cybersecurity unit will conduct shorter, more targeted audits, with the authority reporting approximately 900 incident reports in the past 12 months, 13 percent attributed to actual attacks. From 2022 through August 2026, BaFin announced around 550 supervisory measures and levied over EUR 80 million in fines in the past year alone—underscoring continued enforcement intensity despite the push for simplification.

No specific compliance deadlines are set, but firms should monitor BaFin's ongoing legislative proposals (roughly 20 already implemented/in process and 75 more recently submitted) for simplification of German and EU rules, as these could materially affect reporting and compliance obligations. Financial institutions, especially those with complex or non-core business lines, should proactively review governance frameworks, board expertise and time commitments, and internal separation of duties to preempt BaFin's "troubled company" focused oversight program. Firms should also prepare for shorter-notice, targeted cybersecurity audits and strengthen AML and conduct-of-business controls given BaFin's stated resource reallocation toward these areas.

Source: Federal Financial Supervisory Authority