For outsourcing vs external procurement, the German Minimum Requirements for Risk Management (MaRisk) ask one question: would the institution otherwise perform the activity itself? Since the ninth MaRisk amendment of 30 June 2026, services covered by the EU Digital Operational Resilience Act (DORA) also fall outside the MaRisk outsourcing module, AT 9.
Ask what you would otherwise do yourself. Under AT 9 no. 1, an outsourcing exists if another company performs activities and processes that the institution would otherwise perform itself. Other external procurement is not outsourcing, but the institution must still pay attention to it. ICT (information and communication technology) services under DORA follow DORA, not AT 9.
01
The test
An outsourcing exists if another company performs activities and processes that the institution would otherwise perform itself (AT 9 no. 1). The contract form does not decide: civil-law arrangements cannot rule an outsourcing out.
02
Not outsourcing
One-off or occasional purchases of goods and services, and services that supervised firms typically provide and that the institution cannot supply itself for factual or legal reasons, are other external procurement.
03
From 30 June 2026
ICT services under Article 3 no. 21 DORA that are subject to ICT third-party risk management under Articles 28 to 30 DORA fall outside AT 9. The circular entered into force on publication, with a transition period to 1 January 2027.
04
The consequence
Outsourcings need a risk analysis that shows which are material. § 25b (1) of the German Banking Act (Kreditwesengesetz, KWG) requires a register of all material and non-material outsourcings, and the institution stays responsible (§ 25b (2) KWG).
The rule is an administrative circular, not a statute, and it sits on a statutory base. This overview helps if your head office is outside Germany and the German structures are new to you.
BaFin (the German Federal Financial Supervisory Authority, Bundesanstalt für Finanzdienstleistungsaufsicht) issues the MaRisk circular for banks and supervises how institutions apply AT 9, the outsourcing module.
The Deutsche Bundesbank, the German central bank, publishes the MaRisk together with BaFin and takes part in the ongoing supervision of institutions.
The EU Digital Operational Resilience Act (Regulation (EU) 2022/2554) sets the ICT third-party risk rules. Since 30 June 2026, AT 9 points to Article 3 no. 21 and Articles 28 to 30 DORA to draw the line.
The institution classifies each external service, decides which outsourcings are material and stays responsible for compliance (§ 25b (2) KWG). The outsourcing provider has no say in the classification.
The provider performs the service under a written agreement with instruction and termination rights (§ 25b (3) KWG). Whether it counts as outsourcing is decided by the test, not by the provider.
The circular gives the test, not a list of services. The table applies it to typical services and is our reading, not a BaFin list.
| Service | Classification | Reason |
|---|---|---|
| One-off legal opinion on a product question | Other external procurement | A one-off purchase of a service. |
| Ongoing customer service for card holders | Outsourcing | The institution would otherwise provide the service itself. |
| Standing internal audit work by an audit firm | Outsourcing, usually material | A special function that is otherwise performed inside the institution. |
| Standing external Money Laundering Reporting Officer (MLRO) | Outsourcing, with duties under the German Anti-Money Laundering Act (Geldwäschegesetz, GwG) on top | The function is otherwise performed by the institution itself. |
| A service that only supervised firms supply and the institution cannot provide itself | Other external procurement | Typically bought from a supervised firm and not providable by the institution, for factual or legal reasons. |
| Cloud hosting that is subject to DORA ICT third-party risk management New since 30 June 2026 | DORA, not AT 9 | Excluded by the explanation to AT 9 no. 1. |
Key point
Classify every service once and write down why.
AT 9 no. 1 says that civil-law arrangements cannot rule out an outsourcing. Record the question you asked and the answer, for outsourcings and for purchases you leave out.
The explanation to AT 9 no. 1 describes other external procurement in two groups: one-off or occasional purchases of goods and services, and services that supervised firms typically provide and that the institution cannot supply itself for factual or legal reasons.
This article follows the MaRisk circular for banks, Circular 06/2026 (BA). Payment institutions have their own circular with its own AT 9 (Circular 07/2024 (BA)). We have not checked whether it has been updated to match the new DORA wording, so check which circular applies to you.
Chips in red mark steps that are still ahead.
Done. DORA applies. ICT third-party risk management now follows Articles 28 to 30 DORA for the firms in its scope.
Done. BaFin consults on the draft of the ninth MaRisk amendment.
Done. BaFin publishes the final MaRisk as Circular 06/2026 (BA). It enters into force on publication and replaces the previous version.
Open. The transition period ends for requirements that are new in individual cases. Relief can be used from 30 June 2026.
§ 25b (1) KWG requires an institution to take adequate precautions against excessive additional risks, depending on the nature, scale, complexity and risk content of an outsourcing of material activities and processes. An outsourcing must not impair the orderliness of the business or the business organisation, and risk management must stay adequate and effective and include the outsourced activities. The institution must keep a register of all material and non-material outsourcings (§ 25b (1) sentence 4 KWG).
§ 25b (2) KWG says that outsourcing must not transfer the responsibility of the managing directors to the provider. The institution stays responsible for complying with the statutory provisions that apply to it.
§ 25b (3) KWG requires a written agreement that sets out the institution’s rights, including instruction and termination rights, and the provider’s corresponding duties. BaFin’s rights of information and audit, and those of the institution’s auditors, must stay secured, also for providers in other states. For a material outsourcing to a provider in a third country, the agreement must ensure that the provider names a domestic agent for service of process.
AT 9 no. 2 adds the method. The institution assesses the risks of an outsourcing in a risk analysis that covers all relevant risks, and it decides on that basis which outsourcings are material.
The circular entered into force on 30 June 2026. Where it creates additional requirements in individual cases, a transition period runs until 1 January 2027, according to BaFin’s transmittal letter.
The explanation to AT 9 no. 1 now states that outsourced or externally procured ICT services under Article 3 no. 21 DORA that are subject to ICT third-party risk management under Articles 28 to 30 DORA do not fall under AT 9. Those services are managed under DORA instead.
In practice, each external service lands in one of three boxes: outsourcing under AT 9, other external procurement, or an ICT service under DORA. On our reading, a service that mixes ICT and other parts needs a reasoned split, because AT 9 and DORA each cover only their own part.
§ 28 (6) no. 1 of the German Act on the Federal Office for Information Security (BSI-Gesetz, BSIG) says that §§ 30, 31, 32, 35, 36, 38 and 39 BSIG do not apply to financial undertakings under Article 2 (2) DORA, nor to firms to which DORA applies under § 1a (2) and (2a) KWG. For your institution, the DORA path therefore replaces those BSIG duties. On our reading, a provider that is not itself a financial undertaking can fall under the BSIG as an important or essential entity. That is the provider’s own obligation. It does not change which regime your institution applies to its contract.
Different people carry different parts of the work. The split below follows the functions that usually exist in a German institution.
Sets the outsourcing policy, owns the classification rules and remains responsible for compliance. Management tasks cannot be handed to a provider (§ 25b (2) KWG).
Supports the business units, coordinates and reviews their risk analyses and keeps the outsourcing register (AT 9). It is the single place where the three boxes meet.
Ask the classification question at intake: would we otherwise do this ourselves? They give the facts for the risk analysis.
Runs the DORA path for ICT services that fall under Articles 28 to 30 DORA, outside AT 9.
Checks that classification, risk analysis and register are complete and that the reasoning is recorded.
You hand over the task, not the control. § 25b (2) KWG keeps the responsibility of the managing directors, and the compliance with the statutory provisions, with the institution, whatever the agreement says.
These six points recur where outsourcing is classified by habit and not by the test. They do not replace a review of your own set-up.
Calling a contract a purchase or a licence does not decide the question. Civil-law arrangements cannot rule out an outsourcing.
AT 9 no. 1
Everything in the register inflates the effort. The test is whether the institution would otherwise perform the activity itself.
AT 9 no. 1
Not being an outsourcing does not mean no control. The institution must still pay attention to it.
AT 9, explanation to no. 1
ICT services under DORA now follow DORA. Applying AT 9 in parallel duplicates work or leaves gaps.
Articles 28 to 30 DORA
The register must list all material and non-material outsourcings, not only the material ones.
§ 25b (1) KWG
An agreement can transfer a task but not management responsibility or legal compliance.
§ 25b (2) KWG
Select a status for each of the six questions. Nothing is stored or sent. The check is a self-assessment and does not replace legal advice.
These six steps hold whichever way supervisory practice develops. They build the evidence that a supervisor asks for.
01
List every external service with owner, provider and a first classification. One list is the base for everything else.
02
Put the question “would we otherwise do this ourselves?” into intake and renewals, with a short written answer.
03
Mark ICT services that fall under Articles 28 to 30 DORA and hand them to the ICT risk function.
04
Check that each outsourcing has a risk analysis and that the materiality decision follows from it.
05
Add the non-material outsourcings and check that every entry has an owner and a review date.
06
Map the new MaRisk text against your policy, assign actions and record the result.
Three key messages remain.
Would the institution otherwise perform the activity itself? That decides outsourcing, not the contract label.
Outsourcing under AT 9, other external procurement, and ICT services under DORA.
A supervisor and your auditors will ask why a service sits in its box.
Outsourcing vs external procurement is a question of evidence. If you apply the test to every external service, keep ICT services under DORA in their own box and write down why each service sits where it does, you can show a supervisor how your institution reached each classification.
Where this sits in the S+P service model
Outsourced officer functions, including Central Outsourcing Management and Internal Audit, bundled in the S+P Compliance Package.
Operational work, such as DORA, outsourcing and third-party operations, carried out under your instructions.
Tools such as the S+P Compliance Cockpit that support both.
Officer functions and operational services are delivered separately, in organisation and in staffing.
The answers reflect the position on 30 October 2026 and do not replace legal advice in an individual case.
AT 9 no. 1 defines outsourcing as the commissioning of another company to perform activities and processes related to banking business, financial services or other typical institution services that the institution would otherwise perform itself. Other external procurement is not outsourcing. It covers one-off or occasional purchases of goods and services, and services that supervised firms typically provide and that the institution cannot supply itself for factual or legal reasons. The institution must still pay attention to it.
It depends on the box. Since 30 June 2026, the explanation to AT 9 no. 1 takes ICT services under Article 3 no. 21 DORA that are subject to ICT third-party risk management under Articles 28 to 30 DORA out of AT 9. Those services follow DORA. Other external services follow the test in AT 9 no. 1.
BaFin published the ninth MaRisk amendment as Circular 06/2026 (BA). It entered into force on publication. For requirements that are new in individual cases, a transition period runs until 1 January 2027. For outsourcing, the clearest change is the line to DORA in the explanation to AT 9 no. 1.
On our reading, yes. A standing external Money Laundering Reporting Officer performs a function that the institution would otherwise perform itself, so the test points to outsourcing, and GwG duties apply on top. From 10 July 2027, Article 18 (3) of the EU Anti-Money Laundering Regulation (AMLR) also lists tasks that cannot be outsourced, among them the decision to enter into a business relationship and the report to the FIU.
No. § 25b (2) KWG says that outsourcing must not transfer the responsibility of the managing directors to the provider, and that the institution stays responsible for complying with the statutory provisions that apply to it. A provider can carry out tasks. Control, decision authority and final responsibility stay with your firm.
S+P Compliance prepares and runs the operational work: inventories, draft risk analyses, register maintenance, contract and exit-plan reviews and reporting packs. Stays with you: the classification, the materiality decision, management responsibility under § 25b (2) KWG, the decision to enter into, renew or end an agreement and, where AML tasks are outsourced, the report to the FIU under § 43 GwG. You hand over the task, not the control.
Only official German and EU bodies are linked. The DORA articles are cited as the circular cites them.
Circular 06/2026 (BA): Minimum Requirements for Risk Management (MaRisk) (German). The ninth amendment of 30 June 2026. AT 9 and its explanation to no. 1 contain the outsourcing definition, the other-external-procurement explanation and the DORA line. bafin.de
BaFin transmittal letter of 30 June 2026 (German). Entry into force on publication and the transition period until 1 January 2027. bundesbank.de (PDF) [PDF]
§ 25b Kreditwesengesetz (German). Outsourcing of activities and processes: precautions, register (§ 25b (1)), responsibility (§ 25b (2)) and agreement (§ 25b (3)). gesetze-im-internet.de
§ 28 BSI-Gesetz (German). Exclusion of §§ 30, 31, 32, 35, 36, 38 and 39 BSIG for financial undertakings under DORA (§ 28 (6) no. 1). gesetze-im-internet.de
Regulation (EU) 2024/1624 (AMLR). Article 18 on outsourcing under the anti-money laundering rules. Application from 10 July 2027. eur-lex.europa.eu
Digital operational resilience for the financial sector (German). EU summary of Regulation (EU) 2022/2554 (DORA). eur-lex.europa.eu
Legal position on 30 October 2026. MaRisk is an administrative circular and BaFin can amend it. Check the current text before you rely on it.
Outsourcing classification touches several workstreams. These pages connect.
Support for the outsourcing inventory, the register and the review cycle under your procedures. Classification and materiality decisions stay with your firm.
Support for the DORA register of information, which matters where ICT services leave AT 9. Your firm owns the content and the classification.
The service view for firms that look for an external Money Laundering Reporting Officer for their German entity. Control, decision authority and final responsibility stay with your firm, and reports to the FIU under § 43 GwG are not handed over.
Outsourced MaRisk compliance function for institutions in Germany.
What Article 18 AMLR changes for outsourcing, including the six tasks that stay with your firm.
Outsourced officer functions for institutions in Germany, bundled in one agreement.
We use cookies and similar technologies to improve your experience on our website. Read our Privacy Policy.