Meet BAIT requirements and prepare for the move to DORA

BAIT is BaFin Circular 10/2017 (BA), Bankaufsichtliche Anforderungen an die IT, the German supervisory requirements for IT at banks and financial services institutions. It interprets Section 25a(1) KWG and MaRisk for IT, covering IT strategy, governance, information risk management, information security, identity and rights management, IT projects, IT operations, external IT services, IT contingency management and critical infrastructure. The current version is dated 16 December 2024.

BAIT applies to credit institutions and financial services institutions in Germany that fall within MaRisk scope. Since 17 January 2025, any institution that must operate ICT risk management under DORA Articles 5 to 15 or Article 16 is excluded. In practice BAIT now mainly affects institutions not yet subject to DORA, for example financial services institutions that BaFin expects to come under DORA from 1 January 2027.

Yes. DORA has applied directly in Germany since 17 January 2025, and BaFin narrowed BAIT's scope at that date so that institutions covered by DORA ICT risk management no longer follow it. According to the Bundesbank, BAIT will be repealed completely with expiry of 31 December 2026. BaFin repealed the equivalent circulars for payment, insurance and asset management firms (ZAIT, VAIT and KAIT) with expiry of 16 January 2025.

BAIT itself does not set fines. It is BaFin's interpretation of the organisational duties in Section 25a KWG, so shortcomings are typically raised as findings in Bundesbank or BaFin inspections and audits of the annual financial statements. BaFin can then require the institution to remedy them and may use its wider supervisory powers under the KWG where deficiencies are serious or persist.

BAIT has a preliminary section followed by 12 chapters of requirements, each made up of numbered Textziffern with explanatory notes. Chapters cover IT strategy, IT governance, information risk management, information security management, operational information security, identity and rights management, IT projects and application development, IT operations, outsourcing and other external IT services, IT contingency management and critical infrastructure. Chapter 11 was repealed in the 2024 revision.

BAIT expects institutions to base their IT systems and processes on established standards and names ISO/IEC 270XX and the BSI IT-Grundschutz as examples. ISO 27001 does not replace BAIT, but an ISO 27001 information security management system covers much of BAIT's information security, access and operations content. Banking-specific items such as MaRisk links, quarterly management reporting and outsourcing rules still need separate attention.

It depends on the institution's size, complexity and current maturity, because BAIT follows the principle of proportionality. An institution that already runs an ISO 27001 aligned security programme will mostly need to close banking-specific gaps, while one starting from scratch needs to build strategy, risk analysis, access recertification and contingency testing processes. Given the planned repeal at the end of 2026, many institutions now plan BAIT work alongside DORA.

BAIT is mapped in OneClickComply's control library and is available on request rather than enabled by default. Once enabled, its requirements sit on the same shared controls as ISO 27001 and DORA, so evidence collected through integrations, policies and risk assessments counts towards each. OneClickComply helps you prepare and evidence compliance, while supervision and inspections remain with BaFin and the Bundesbank.