The New Compliance Function: Implementation of CRD VI and the EBA Guidelines on Internal Governance – Part 2 (german only)

At the heart of the matter is a finding that calls into question the widely held assumption of reduced regulatory burden: While excluding significant institutions (SIs) from the scope of MaRisk eliminates dual supervision, it simultaneously shifts the consolidation function previously provided by MaRisk to a fragmented source architecture. For the institutions concerned, the supposed elimination of requirements therefore does not mean relief, but rather an additional integration burden.

A second focus is on the scope of legal monitoring: While MaRisk focuses on identifying the essential legal regulations, the EBA draft requires, in principle, comprehensive monitoring of all applicable areas of law, followed by risk-based prioritization. In response to this tension, the authors develop the concept of a Regulatory Compliance Risk Assessment (RCRA) as a tool for risk-oriented, institution-specific prioritization. In doing so, they demonstrate that the obligation to identify material legal provisions remains in effect regardless of an institution’s size, and that only the structural design of the compliance function must be scaled proportionally.

Published in Compliance-Berater (CB) 7/2026.

To the article (German only): https://beck-online.beck.de/?typ=reference&y=300&z=CB&b=2026&s=269&n=1