Financial Supervision | Compliance

BaFin Compliance: BAIT, MaRisk and DORA

BaFin (Bundesanstalt fur Finanzdienstleistungsaufsicht) is Germany's integrated financial supervisory authority - comparable to the FCA in the UK or the SEC/OCC in the US. Banks and financial institutions in Germany are subject to the strictest IT security requirements: BAIT, MaRisk and since January 2025 DORA define binding standards for IT governance, information security and digital operational resilience.

Request BaFin Compliance Consulting DORA Topic Page

Last updated: March 2026

BaFin IT Circulars: 5; BAIT, MaRisk + DORA since 01/2025
VAIT repealed: 17 Jan 2025; KAIT and ZAIT also repealed
ENISA Finance Incidents: 488; Reported incidents in EU financial sector (2023)
Banks with cyber incident: 61%; According to EBA/ENISA Threat Landscape

Overview

BaFin Regulatory Framework: Who Must Comply With What

BaFin has issued several IT-specific circulars applying to different institution types. Since January 2025, DORA has fundamentally changed the regulatory landscape.

Framework	Scope	Status (as of 2025)
BAIT Supervisory Requirements for IT in Financial Institutions	Credit institutions under the KWG (German Banking Act)	Still valid (alongside DORA)
MaRisk Minimum Requirements for Risk Management	Credit institutions under the KWG	Still valid (IT sections supplemented by DORA)
DORA Digital Operational Resilience Act (EU 2022/2554)	Broad range of financial institutions (directly applicable)	In force since 17 Jan 2025 - takes precedence as EU regulation
VAIT Supervisory IT Requirements for Insurance Companies	(formerly insurance companies)	Repealed since 17 Jan 2025 - replaced by DORA
KAIT Requirements for Capital Management Companies	(formerly capital management companies)	Repealed since 17 Jan 2025 - replaced by DORA
ZAIT IT Supervisory Requirements for Payment Service Providers	(formerly payment service providers)	Repealed since 17 Jan 2025 - replaced by DORA

Transition

What Applies Under DORA: The New Legal Framework Since January 2025

With effect from 17 January 2025, DORA (Digital Operational Resilience Act, EU 2022/2554) applies directly to a broad range of financial institutions. As an EU regulation, DORA is directly applicable - without national implementing legislation.

DORA has fully repealed three of the previous BaFin IT circulars: VAIT (insurance companies), KAIT (capital management companies) and ZAIT (payment service providers) are no longer in force. For credit institutions, BAIT continues alongside DORA but loses practical significance where DORA governs the same requirements directly.

For more detail on DORA requirements, scope and the ICT risk management framework, see our DORA topic page.

DORA Core Obligations at a Glance

ICT Risk Management Framework

Complete ICT risk register, risk classification, control mechanisms and reporting to management bodies. Management bodies bear personal responsibility for adequate DORA compliance.

Reporting of Major ICT Incidents

4-hour early warning, 24-hour initial notification, 72-hour detailed report and 1-month final report for significant ICT incidents to the competent authority.

TLPT - Threat-Led Penetration Testing

For significant institutions: regulatory mandated advanced penetration tests (Threat-Led Penetration Testing, TLPT) every 3 years following the TIBER-EU methodology.

ICT Third-Party Risk Management

Complete register of all ICT third-party service providers, risk classification, contractual DORA minimum requirements, exit strategies. Critical ICT service providers are supervised directly by EBA/ESMA/EIOPA.

§44 KWG

BaFin IT Audits: What Is Examined

BaFin special audits under §44 KWG can be ordered at any time. The IT audit focus areas are clearly defined - structured preparation is possible and advisable.

IT Governance

IT strategy and documentation (BAIT AT 1)
IT organisational structures and responsibilities
IT reporting to management bodies
IT budget management and resource planning

Information Risk Management

Complete risk register for all IT systems
Risk classification by criticality
Regular risk assessment and updates
Risk reports to board and supervisory board

Information Security Management

ISMS documentation and policies
Regular penetration tests (BAIT AT 7.3)
Vulnerability scans and patch management
Security awareness training

Outsourcing Management

Complete outsourcing register (§25b KWG)
Risk classification of all IT outsourcing
Contractual minimum requirements (exit, audit, SLA)
Ongoing outsourcing monitoring

Contingency & Business Continuity

Contingency plan for critical IT systems
Regular BCP/DR tests and documentation
Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)
Communication plans for IT disruptions

Access Rights Management

Role-based access control (RBAC)
Privileged Access Management (PAM)
Regular access rights reviews
Full audit trail of privileged access

Frequent BaFin findings: Inadequate documentation of IT risk classification, missing or outdated penetration test reports, poor outsourcing controls without regular supplier audits, no BCP tests, incomplete access rights reviews and missing escalation paths for security incidents.

Threat Landscape

Cyber Threats in the Financial Sector: ENISA Data

The financial sector is the primary target of cybercriminals worldwide. According to the ENISA Threat Landscape for the Finance Sector 2024, 488 significant security incidents in the EU financial sector were documented - with a clearly rising trend.

BaFin reporting obligations capture only a fraction of actual incidents. Financial institutions are attractive targets not only for direct financial damage but also for systemic risk: a successful attack on a major bank can destabilise the entire financial system.

DORA has therefore significantly tightened reporting obligations and response times - 4-hour early warnings and 24-hour initial notifications are the new reality for all DORA-obligated institutions.

Financial Sector Cybersecurity in Numbers

600+

BaFin-reported ICT incidents per year (estimate, actual figure likely higher)

488

Significant ENISA incidents in EU financial sector (2023)

58%

DDoS attacks as the most common attack type against financial institutions

61%

Banks that experienced a significant cyber incident in the last 3 years

65%

Ransomware share in successful attacks on financial institutions

4 h

DORA early warning deadline from detection of a major ICT incident

Sources: ENISA Threat Landscape for the Finance Sector 2024; EBA Risk Assessment Report 2024; BaFin Annual Report 2024.

„BaFin IT audits are not a surprise - the audit focus areas are well known. What I consistently see in practice: institutions that carry out penetration tests and documentation reviews regularly pass these audits without issue. The effort for continuous compliance is a fraction of the effort required for reactive crisis remediation.“

Oskar Braun

ISO 27001 Lead Auditor (IRCA certified) · AWARE7 GmbH

Why AWARE7 for BaFin Compliance

What sets us apart from other providers

Pure awareness platforms don't test systems. Pure consulting firms are too far removed. AWARE7 combines both: we hack your infrastructure and train your employees: tailored to mid-sized companies, personal, without enterprise overhead.

Research and teaching as our foundation

20 %

Around 20% of our revenue comes from research projects for the BSI and the BMBF. Our studies, published at ACM and Springer conferences, analyse millions of websites and tens of thousands of phishing emails. Three of our executives are professors at German universities at the same time.

Digital sovereignty: no compromises

100 %

From first contact to final report, your data is stored on our own servers in Germany - no US cloud providers, no third-country transfers. Our AI also runs on our own hardware in Germany - with locally operated open-source models. Client and project data never reach external AI services. All staff are permanently employed, covered by social insurance and bound by uniform legal obligations.

Fixed price within 24h: predictable project timelines

24 h

Within 24 hours you receive a binding fixed-price quote without hourly rate risk. A well-practised team and standardised processes ensure a clear schedule with a defined start and end date.

Your dedicated contact

1:1

A personal project manager accompanies you from the first meeting to the retest. You book appointments directly with your contact person and keep the same contact throughout the project.

Peer-reviewed publications

Different Seas, Different Phishes - Large-Scale Analysis of Phishing Simulations

ACM AsiaCCS 2025

Oskar Braun, Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann

A Platform for Physiological and Behavioral Security

NSPW 2025

Jan Hörnemann

Privacy from 5 PM to 6 AM: Tracking and Transparency in the HbbTV Ecosystem

IEEE/IFIP DSN 2025

Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann

Understanding Regional Filter Lists: Efficacy and Impact

PoPETS 2025

Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann

Who is AWARE7 the right partner for?

Mid-sized companies with 50-2,000 employees

Companies that need real security, without paying for a DAX-corporation provider. Fixed price, clear scope, one point of contact.

IT managers & CISOs

Who have to argue convincingly in-house and need a report in boardroom language for that, not just technical findings.

Regulated industries

Critical infrastructure, healthcare, financial services: NIS-2, ISO 27001, DORA. We know the requirements and deliver evidence that auditors accept.

FAQ

Frequently Asked Questions about BaFin Compliance

Answers to the most common questions about BAIT, MaRisk, DORA transition and BaFin IT audits for financial institutions.

What is BAIT and is it still valid?

BAIT stands for "Bankaufsichtliche Anforderungen an die IT" (Supervisory Requirements for IT in Financial Institutions) and is the BaFin IT security circular for credit institutions under the German Banking Act (KWG). BAIT remains valid - but with a considerably reduced scope since the Digital Operational Resilience Act (DORA, EU 2022/2554) entered into force on 17 January 2025. DORA has fully repealed the VAIT (insurance companies), KAIT (capital management companies) and ZAIT (payment service providers) circulars. BAIT still applies to institutions primarily subject to the KWG that are not fully covered by DORA. Companies should assess whether they fall under DORA - in that case DORA is the governing framework, supplemented by BAIT where still applicable.

What is MaRisk and how does it relate to IT security?

MaRisk (Minimum Requirements for Risk Management) is the comprehensive BaFin circular on risk management for credit institutions. It addresses all material risk types - including operational risks, of which IT risks and cyber risks form a part. MaRisk requires an integrated risk management system that systematically identifies, assesses, controls and monitors IT risks as part of operational risks. AT 7.2 MaRisk contains specific requirements on technical and organisational equipment - including: appropriate IT systems, data backups, contingency plans and access rights management. With DORA, IT-specific requirements are increasingly anchored there, while MaRisk continues as the general risk management framework.

Which BaFin circulars concern IT security?

The relevant BaFin circulars for IT security are: BAIT (RS 10/2017): Supervisory Requirements for IT in Banks - for credit institutions under the KWG; contains requirements on IT strategy, IT governance, information risk management, information security management, operations and contingency management. MaRisk (RS 05/2017): Minimum Requirements for Risk Management; AT 7.2 addresses technical and organisational equipment. EBA SREP Guidelines: European requirements beyond MaRisk. DORA (from 17 Jan 2025): For institutions in scope, DORA is the primary framework and has replaced VAIT, KAIT and ZAIT. The requirements of BAIT and DORA overlap substantially; for DORA-obligated institutions, DORA takes precedence.

What changed for BAIT/VAIT/KAIT/ZAIT when DORA came into force?

When the Digital Operational Resilience Act (DORA, EU 2022/2554) entered into force on 17 January 2025, BaFin fully repealed VAIT (supervisory requirements for IT in insurance companies), KAIT (requirements for capital management companies) and ZAIT (IT supervisory requirements for payment service providers). BAIT remains in force but loses relevance for many institutions because DORA, as an EU regulation (directly applicable, without national implementing act), takes precedence. DORA applies to: credit institutions, investment firms, payment institutions, e-money institutions, insurance companies, asset managers, rating agencies, trading venues, trade repositories and ICT third-party service providers. Core obligations under DORA: ICT risk management, reporting of major ICT incidents (within 4h/24h/72h), DORA penetration tests (TLPT), management of ICT third-party risks and information sharing.

What does BaFin examine in a §44 KWG special audit?

In a special audit under §44 of the German Banking Act (KWG), BaFin can examine all aspects of a credit institution's business organisation and risk management - including IT security and operational stability. Typical IT audit focus areas are: IT governance and responsibilities (who is responsible for IT security?), information risk management (BAIT Chapter 2: recording and assessment of IT risks), information security management (ISMS, security policies, penetration tests), outsourcing management (§25b KWG, BAIT Chapter 9: oversight of outsourced IT service providers), contingency and business continuity management, access rights management (role-based access control, privileged access management), and incident management (detection and escalation processes). Frequent BaFin findings: inadequate documentation, missing or outdated penetration test reports, poor outsourcing controls without regular supplier audits, no BCP tests, incomplete access rights reviews and missing escalation paths for security incidents.

How do I prepare for a BaFin IT audit?

Structured preparation for BaFin IT audits covers several areas: Documentation check: all IT security policies, the information risk register, penetration test reports and outsourcing contracts must be complete and current. BAIT gap analysis: comparison of all BAIT requirements against the current implementation status - ideally by an external reviewer with BaFin experience. Penetration tests and vulnerability scans: regular tests document the "regular review of IT systems" (BAIT AT 7.3). DORA readiness: assessing whether the institution falls under DORA and which DORA requirements (TLPT, ICT third-party management, reporting obligations) need to be implemented. Mock audit: internal mock audits simulate the audit process and uncover remaining gaps. AWARE7 supports with structured BAIT/DORA gap analyses and penetration tests.

Do I need BAIT or DORA?

The distinction between BAIT and DORA depends on the institution's regulated status. DORA applies to a very broad range of financial institutions - credit institutions, investment firms, payment institutions, insurance companies and many more. For all institutions falling under DORA, DORA as an EU regulation takes precedence. BAIT continues as a BaFin circular but loses practical relevance for DORA-obligated credit institutions, as DORA governs the relevant IT requirements more directly and comprehensively. For smaller institutions that may use DORA proportionality provisions, BAIT remains relevant as a reference framework. Recommendation: have an expert assess whether and to what extent DORA applies to your institution - and which additional BAIT requirements exist.

How does AWARE7 support BaFin compliance?

AWARE7 supports financial institutions with specialised cybersecurity services for BaFin compliance: BAIT gap analysis: structured comparison of all BAIT requirements against the current implementation status, including action plan. DORA readiness assessment: analysis of DORA scope, gap analysis on ICT risk management, incident reporting and ICT third-party management. Penetration tests (web, network, cloud) to fulfil BAIT AT 7.3 requirements and DORA TLPT preparation. ISO 27001 ISMS implementation as a structured foundation that systematically addresses BAIT and DORA requirements. Vulnerability management and continuous monitoring. Preparation for BaFin audits through internal mock audits and documentation reviews.

Aus dem Blog

Weiterführende Artikel

Alle Artikel

Netzwerk- & Endpoint Security 04. März 2026

Datenbanksicherheit: PostgreSQL, MySQL und MSSQL richtig absichern

Datenbank-Härtung für PostgreSQL, MySQL und MSSQL: Least-Privilege-Rollen, Audit-Logging, Verschlüsselung und SQL-Injection-Prävention.

Vincent Heinen

11 Min.

Compliance & Standards 01. Juli 2020

Der Informationssicherheitsbeauftragte - Zuständigkeiten und Aufgaben!

Der Informationssicherheitsbeauftragte ist der Ansprechpartner für Informationssicherheit im Unternehmen. Diese Aufgaben hat er!

Jan Hörnemann

2 Min.

Compliance & Standards 07. Februar 2024

PCI DSS: Der Sicherheitsstandard für Kreditkartenzahlungen erklärt

Erfahren Sie, warum PCI DSS für Unternehmen, die Kreditkartenzahlungen akzeptieren, unverzichtbar ist und schützt.

Approach BaFin Compliance Systematically

AWARE7 supports financial institutions with BAIT gap analyses, DORA readiness assessments and regulatory-grade penetration tests. Fixed-price proposal after a free initial assessment.

Free BaFin Compliance Initial Consultation

Free · 30 minutes · No obligation