The image shown in this blog post is a screenshot of the 3D visualization of Data2Space. It is not an AI-generated image created to illustrate the application. The visualization shown is part of the actual Data2Space application, which can be explored interactively in 3D, with all relevant information from the WpI MaRisk available directly within the application.

A new planning dimension for small and medium-sized investment firms in Germany

With Circular 09/2026 (WA), “Minimum Requirements for Risk Management of Investment Firms (WpI MaRisk)”, BaFin has established a dedicated regulatory framework for small and medium-sized investment firms in Germany. The new framework is designed specifically around the characteristics and risk profiles of these institutions, replacing the previous need to apply the banking-oriented MaRisk framework by analogy. The German Bundesbank describes the WpI MaRisk as a flexible and compact framework intended for small and medium-sized investment firms (BaFin).

The significance of the new framework goes beyond the number of pages in the circular. Its real importance lies in the need to translate a comprehensive set of regulatory principles into a coherent organisational, procedural and documentary system. For institutions that have to be ready by the end of 2026, the central question is therefore no longer simply What does the WpI MaRisk require? It is:

How can all requirements be brought together in a way that allows management, risk management, compliance and internal audit to see the entire implementation landscape at once?

This is precisely where spatial computing and Data2Space can offer a new approach.

A dedicated regulatory architecture for investment firms

The WpI MaRisk is aimed at small and medium-sized investment firms, while large investment firms remain subject to the banking MaRisk framework. The second consultation draft was deliberately made more compact and more principles-based, with a stronger focus on proportionality and the specific risk profile of investment firms (Bundesbank).

The architecture covers, among other things:

• the scope of application and definitions;
• management and supervisory-body responsibilities;
• risk-bearing capacity and capital planning;
• strategies;
• internal control mechanisms;
• risk management, compliance and internal audit functions;
• organisational policies and documentation;
• resources and technical-organisational infrastructure;
• contingency management;
• change and new-product processes;
• outsourcing;
• specific requirements for trading activities;
• tied agents;
• risk management processes;
• risks arising from ongoing activities;
• risks to clients, the market and the investment firm;
• other risks;
• liquidity risks;
• the risk of an orderly or disorderly wind-down; and
• risk reporting.

This structure is particularly interesting because the WpI MaRisk does not merely reproduce the traditional banking risk taxonomy. Its logic places considerable emphasis on the effects of risks — including Risk to Firm, Risk to Client and Risk to Market — and requires institutions to map their own risk management arrangements onto this framework.

The result is a regulatory landscape in which individual requirements are not isolated. They are connected to responsibilities, processes, policies, controls, risks, evidence and reporting. That interconnectedness is precisely what makes implementation difficult.

The implementation problem: compliance is a network, not a checklist

A conventional implementation project often starts with a spreadsheet. One column contains the regulatory requirement. Another contains the responsible function. Further columns identify the current status, the required action, the target date, the evidence and perhaps the relevant policy or procedure. This approach is useful. But it has an inherent limitation: the spreadsheet forces a multidimensional problem into a two-dimensional sequence of rows and columns.

A WpI MaRisk requirement can simultaneously be:

• relevant to several organisational functions;
• connected to several risks;
• implemented through several processes;
• documented in several policies;
• supported by several controls;
• dependent on an outsourcing arrangement;
• subject to proportionality considerations;
• relevant to several legal entities; and
• associated with evidence that must later be demonstrated to internal or external reviewers.

A list can tell management whether individual tasks have been completed. It is much less effective at showing how the tasks relate to one another. The challenge is therefore not merely completeness. It is maintaining a mental model of the entire implementation.

Turning the WpI MaRisk into an information space

This is where Data2Space introduces a fundamentally different perspective. Data2Space transforms complex data into interactive three-dimensional information spaces. Its architecture is designed to integrate information from enterprise systems, databases, spreadsheets, documents, knowledge graphs and other sources and to represent entities and their relationships as spatial objects. (data2space.com) Applied to WpI MaRisk implementation, the regulatory framework could become a spatial compliance landscape.

Imagine the WpI MaRisk at the centre of the information space. Around it, individual requirements form interconnected nodes. Those requirements can be connected to:

Regulatory requirement → risk → policy → process → control → responsible function → evidence → implementation status → deadline

A requirement concerning internal control mechanisms could therefore be connected directly to the relevant compliance control, risk management process, policy document, responsible officer and evidence of implementation. An outsourcing requirement could simultaneously be connected to the relevant service provider, outsourcing register, risk assessment, contractual arrangements, DORA-related information and internal control activities. The space consequently becomes more than a visual copy of the table of contents. It becomes a map of the implementation architecture.

The attached image: an important first step, but not yet spatial computing

The accompanying image provides a compelling illustration of this idea.

At its centre is the WpI MaRisk as a conceptual regulatory object. Around it, the major sections and individual requirements appear as nodes in a three-dimensional network. Labels such as AT 2, AT 4, AT 7, AT 8, AT 9, BTH, BTV, BTR and the individual risk categories can be perceived as different elements of a larger regulatory system. The image already communicates something that a conventional table of contents cannot: the requirements exist in relation to one another. It also suggests a useful implementation methodology. Instead of asking only whether AT 4.3.2 or BTR 3 has been addressed, an institution can ask:

What is this requirement connected to?

Which process implements it?
Which function owns it?
Which risk does it address?
Which control demonstrates compliance?
Which document provides the evidence?
Which other WpI MaRisk requirements depend on the same implementation activity?

That is the beginning of spatial compliance planning. But the image also demonstrates why a static screenshot is ultimately insufficient.

Why a screenshot can never reproduce the spatial experience

The attached picture is merely a photo, resulting in a projection of a three-dimensional information environment onto a two-dimensional surface. It therefore communicates the concept, but it cannot reproduce the experience of being inside the information space. This distinction is fundamental.

When looking at the image, the viewer sees a fixed perspective. Nodes overlap. Some labels are partially hidden. Objects in the background become difficult to read. Distances are represented visually, but they cannot actually be experienced as distances.

A spatial-computing headset changes this relationship.

Instead of looking at the regulatory landscape, the user can look into and around it.

The distinction may appear subtle, but it has major consequences for complex information.

Depth becomes perceptible

On a conventional screen, depth is represented through perspective, size and overlap. With a spatial-computing headset, depth can be experienced directly. A requirement can appear physically closer to the risk, control or document to which it relates. Another cluster can be positioned further away. The user can move closer to a particular regulatory area and move away again to regain the overall picture. The hierarchy therefore becomes something that is not merely read but experienced spatially.

Parallax reveals relationships

When the viewer moves their head, objects at different distances move relative to one another. That parallax effect provides an additional perceptual cue that a screenshot cannot reproduce. A static image contains only one viewpoint. Spatial computing provides a continuously changing viewpoint. This is particularly valuable in dense regulatory networks because relationships that appear to overlap from one angle can separate naturally when the user changes position.

Scale becomes an analytical tool

A regulatory framework can be experienced at different scales. The user might first see the entire WpI MaRisk as a single landscape. Then a movement toward AT 4 can reveal its substructure. Moving closer again can reveal individual requirements, controls and evidence. This is conceptually similar to moving from a map of Germany to a city, then to a street, then to a building — except that the objects themselves can contain information and relationships. Data2Space explicitly describes capabilities such as navigating complex structures, zooming from high-level overviews to detail, dynamically filtering information and highlighting relationships.

The user can change perspective

A two-dimensional screenshot fixes the viewer in one position. A spatial environment does not. A Chief Risk Officer might examine the WpI MaRisk from the perspective of risk categories. Compliance might focus on controls and policies. Internal Audit might focus on evidence and testing. Senior management might focus on implementation status and critical dependencies. The underlying information can remain the same while the perspective changes. That is particularly powerful for a regulatory framework whose implementation crosses organisational boundaries.

Seeing all requirements at once

The phrase “all requirements in view at the same time” should not be understood merely as putting every paragraph onto one enormous screen.

The real advantage is different.

Spatial computing allows the user to maintain a simultaneous perception of the whole and the parts.

In a conventional document, the reader must continually switch between levels:

1. read a requirement;
2. open another document;
3. inspect a process;
4. return to the requirement;
5. check the responsible function;
6. search for evidence;
7. return to the implementation plan.

The cognitive burden comes from repeatedly reconstructing the relationships.

A spatial information environment can instead preserve those relationships visually. The entire regulatory structure can remain present in the background while the user investigates one specific requirement in detail.This is the difference between navigation through documents and navigation through an information space.

From regulatory requirements to an implementation landscape

For a small or medium-sized investment firm, a Data2Space-based WpI MaRisk environment could therefore be organised into several dimensions.

1. Regulatory dimension

The complete WpI MaRisk hierarchy forms the regulatory backbone:

AT → individual requirements → BT → BTH/BTV/BTR → individual risk requirements.

2. Organisational dimension

Each requirement can be associated with its responsible organisational function:

• Management Board;
• Risk Management;
• Compliance;
• Internal Audit;
• Operations;
• Trading;
• IT;
• Outsourcing management; and
• Supervisory functions.

3. Process dimension

Requirements can be connected to the business and risk processes through which they are implemented.

4. Evidence dimension

Policies, procedures, minutes, risk assessments, reports, control results and other evidence can be linked directly to the relevant requirement.

5. Status dimension

Each requirement can carry an implementation status such as:

Implemented → Partially implemented → Gap identified → Action required → In progress → Ready for testing → Tested.

6. Time dimension

The implementation deadline can become another dimension of the space.

Requirements requiring immediate attention could be brought visually to the foreground. Completed areas could recede. Critical dependencies could be highlighted.

The implementation plan thereby becomes not merely a project plan, but a spatial model of regulatory readiness.

Why this matters now

The timing is critical.

The regulatory transition means that small and medium-sized investment firms cannot afford to treat the WpI MaRisk as a document that can simply be read once and filed away. The industry discussion around the second consultation draft already emphasised that the new framework is more principles-based and that greater flexibility comes with greater responsibility for institutions to explain and document their approaches. (idw)

The practical challenge is therefore to distinguish between:

• requirements that are already satisfied;
• requirements satisfied in substance but insufficiently documented;
• requirements requiring a policy adjustment;
• requirements requiring a process adjustment;
• requirements requiring new controls;
• requirements requiring new evidence; and
• requirements where proportionality needs to be explicitly justified.

This is why careful planning is now more important than simply working faster.

A firm that discovers a missing dependency in December has very little room to redesign its organisation, documentation or controls. A firm that sees that dependency in September can still act systematically.

The role of Data2Space in implementation planning

Data2Space should not be understood as a replacement for a compliance management system, document management system or project-management tool.

Its potential value lies in adding a spatial layer to those existing systems.

Data2Space is designed to integrate information from different sources rather than requiring organisations to replace their existing systems. The platform can combine data from applications, databases, APIs, spreadsheets, documents and knowledge graphs and turn them into an interactive spatial model. (data2space.com)

For WpI MaRisk implementation, this means that the existing compliance universe could remain the authoritative source while Data2Space becomes the visual navigation and decision layer.

That distinction is important. The objective is not to make compliance look futuristic. The objective is to make complexity cognitively manageable.

A new form of management meeting

Consider a management meeting shortly before the implementation deadline.

Instead of circulating a 100-line Excel spreadsheet, the responsible team could enter a shared WpI MaRisk information space.

• The management team sees the entire regulatory structure.
• A cluster of unresolved requirements becomes visible.
• Selecting the cluster reveals the responsible function.
• Selecting the function reveals the affected processes.
• Selecting a process reveals the relevant controls.
• Selecting a control reveals the evidence.
• A further layer shows the deadline and dependencies.

The conversation changes from:

“How many requirements are still open?”

to:

“Which unresolved requirements create the greatest implementation dependency, and what must we do now?”

That is a fundamentally more useful management question.

The headset is not a gimmick

The most important distinction is therefore not between 2D and 3D graphics, but between looking at a representation and occupying an information environment.

A monitor can display a three-dimensional model.

A screenshot can depict a spatial network.

Neither creates the full experience of spatial computing.

A suitable headset can provide stereoscopic depth, head-tracked perspective and an embodied sense of position within the information environment. This changes the user’s relationship with the information from passive observation to spatial exploration.

Data2Space is explicitly designed to make information available across web, desktop and immersive XR environments, meaning that spatial computing does not have to replace conventional working methods. (data2space.com)

This also explains an important paradox of the attached image:

The better the image succeeds in suggesting a spatial environment, the more clearly it reveals what is missing from the static representation.

The image shows the viewer what the information space might look like.

The headset allows the viewer to experience what it is like to be inside it.

From regulatory burden to navigable space

For small and medium-sized investment firms, the WpI MaRisk represents a significant implementation task. But the problem is not simply the volume of regulation.

It is the number of relationships between requirements, risks, responsibilities, processes, controls, documents, evidence and deadlines.

Those relationships are inherently multidimensional.

Data2Space offers a way to represent that multidimensionality as a navigable information space. Instead of forcing the implementation into a sequence of rows, pages and screens, the institution can create an environment in which the regulatory structure remains visible as a whole while individual requirements can be examined in detail.

And this is ultimately the most important benefit of spatial computing for WpI MaRisk implementation:

It can preserve the overview while allowing the user to work in the detail.

For institutions working toward year-end readiness, that ability to see the whole implementation landscape — and to understand how individual requirements connect to one another — can make the difference between merely completing a checklist and actually understanding the architecture of regulatory compliance.

Data2Space therefore points toward a different model of regulatory implementation: from documents to relationships, from checklists to information spaces, and from viewing compliance to navigating it.