Germany BAIT

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-12-31 in 52 days BAIT cease to apply in full at the end of the day, after the DORA transition period
2. 2027-01-01 in 53 days Further institutions fall within DORA's scope under section 1a(2) of the Banking Act, as revised by the Financial Market Digitalisation Act (FinmadiG)
3. 2025-01-17 Version of 16 December 2024 takes effect; DORA applies and institutions under its ICT risk management rules leave the BAIT's scope
4. 2024-12-19 BaFin announces to the industry associations that the BAIT will be repealed in stages

1. 2024-12-16
   Circular 10/2017 (BA) in the version of 16 December 2024 AmendmentCurrent text

   Effective 17 January 2025, institutions subject to DORA ICT risk management are taken out of scope and chapter 11 is repealed; the requirements themselves do not change. source

   More

   • It replaced the version of 16 August 2021, which ceased to apply when it took effect.
   • BaFin skipped a consultation because scope was only narrowed and obligations reduced.
2. 2021-08-16
   Circular 10/2017 (BA) in the version of 16 August 2021 Revision

   The version in force until the end of 16 January 2025. source

Since 17 January 2025 the BAIT cover only institutions not yet under DORA's ICT risk management rules; further institutions come under DORA from 1 January 2027.

Scope

The scope is the same as in AT 2.1 of the Minimum Requirements for Risk Management (MaRisk); the circular is issued to all credit institutions and financial services institutions in Germany. source

DORA institutions excluded

From 17 January 2025, institutions required to implement ICT risk management under Articles 5 to 15 or Article 16 of Regulation (EU) 2022/2554 (DORA) are exempt. source

Transition

Institutions that enter DORA's scope on 1 January 2027 keep applying the BAIT until then, so that no regulatory gap arises. source

Critical infrastructure

Chapter 12 adds requirements for operators of critical infrastructure, who may use it for the verification required under section 8a(3) of the BSI Act. source

Institutions implement the requirements themselves, proportionately; critical infrastructure operators also provide BSI Act verification at least every two years.

Requirement areas

IT strategy, IT governance, information risk management, information security management, operational information security, identity and access management, IT projects and development, IT operations, outsourcing, and IT service continuity. source

Information security officer

The management board must establish an information security officer function, which reports to it at least once a quarter and ad hoc (items 4.4 and 4.10). source

Further standards

Institutions must also apply generally established standards, such as BSI IT-Grundschutz and the ISO/IEC 270XX series. source

KRITIS verification

Critical infrastructure operators provide the verification under section 8a(3) of the BSI Act for the first time in 2018 and at least every two years thereafter (item 12.5). source

The circular specifies the Banking Act's organisational requirements; firms outside DORA must still handle ICT and cyber risks as part of proper business organisation.

Legal basis

The circular gives a framework on the basis of section 25a(1) KWG for institutions' technical and organisational resources and specifies section 25b KWG on outsourcing. source

Institutions outside DORA

Supervised firms not covered by DORA must still take measures to handle ICT and cyber risks appropriately as part of proper business organisation. source

1. Guidance Rundschreiben 10/2017 (BA) - BAIT, version of 16 December 2024 (BaFin, German, binding)
2. Guidance Circular 10/2017 (BA) - BAIT, English information translation (BaFin)
3. Guidance Aufhebung der Aufsichtlichen Anforderungen an die IT - letter to the associations, 19 December 2024
4. Guidance BaFin news on DORA and the stepwise repeal of the BAIT, 10 January 2025

1. DORA

   The EU regulation that replaces the BAIT: its ICT risk management rules largely cover the BAIT's requirements, which is why BaFin repeals the circular.

2. EBA GL/2019/04

   The EBA's EU-wide guidelines on ICT and security risk management for banks, investment firms and payment service providers.

3. BSI IT-Grundschutz

   The BSI methodology the BAIT names as one of the generally established standards institutions should apply.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Germany BAIT (RSS)