What is Germany's AML legal framework? The Money Laundering Act and the laws around it
BaFin will run at least 75 special inspections in 2026, says its Risks in Focus 2026 report. At banks the inspectors look at customer risk classification systems and at the travel rule for crypto service providers; elsewhere, at how firms monitor relationships and transactions. Most of what they test sits in the Money Laundering Act (Geldwäschegesetz, GwG) of 23 June 2017, last amended on 29 June 2026.
The GwG follows the EU AML directives (its § 27(1) names the FIU under Directive (EU) 2015/849), so anyone who knows the AML rules in other jurisdictions of the EU will recognize its structure. The thresholds, supervisors and fines are German.
Besides risk management, due diligence and FIU reporting, its sections 18 to 26a run the Transparency Register of beneficial owners.
Money laundering itself is a crime under section 261 of the Criminal Code (§ 261 StGB), which lists no predicate offenses: an object derived from any unlawful act (rechtswidrige Tat) qualifies.
Around the GwG, anti money laundering work also uses the Banking Act (Kreditwesengesetz, KWG), which adds safeguards for institutions and, for banks, monitoring systems.
BaFin's MaRisk circular 05/2023 sets risk management rules for banks and financial services institutions under KWG § 25a.
The Securities Trading Act (WpHG) defines the organized market (§ 2(11)) whose listed companies skip the GwG's 25 percent owner test (§ 3(2)).
Sanctions rest on the Foreign Trade and Payments Act (AWG) and the Sanctions Enforcement Act (SanktDG).
The FATF rated Germany on 25 August 2022: substantial effectiveness on four of 11 immediate outcomes (1, 2, 8 and 9), moderate on the other seven. A follow up report of 7 December 2023 rerated two Recommendations; the country page lists nothing later (capture of 6 September 2026).
Who regulates AML in Germany? BaFin, the FIU and the other regulators
| Supervisor | Who it supervises (GwG § 50, in force November 2026) | AML role (as of November 2026) |
|---|---|---|
| BaFin (Federal Financial Supervisory Authority) | Credit institutions other than the Bundesbank, financial services institutions, payment and electronic money institutions, investment firms, CASPs, issuers of asset referenced tokens, investment management companies, German branches of foreign institutions, EEA payment institutions' agents, KfW (no. 1) | Special inspections, orders and fines; publishes final measures and fines (§ 57) |
| Insurance supervisor | Insurers in § 2(1) no. 7, which covers life insurance and similar products (no. 2) | The competent insurance supervisor for each insurer |
| Bar chambers, Patent Attorneys' Chamber, presidents of regional courts | Lawyers, patent attorneys, notaries (nos. 3 to 5) | Professional supervisors |
| Federal Office of Justice | Legal advisers outside a bar chamber (no. 5a) | Supervisor |
| Chamber of Public Accountants, tax advisers' chambers | Auditors, sworn accountants, tax advisers (nos. 6, 7) | Professional supervisors |
| Gambling supervisors | Gambling operators (no. 8) | Supervisor, unless state law decides otherwise |
| Body competent under federal or state law | Everyone else, for example real estate agents, goods traders, art intermediaries, trust and company service providers (no. 9) | Non financial sector supervisor |
| FIU (Zentralstelle für Finanztransaktionsuntersuchungen) | Takes reports from every obliged entity (§ 28(1)) | Analyzes reports, can ban transactions and order other immediate measures, passes results to the competent public bodies; organizationally independent (§ 27(2)); a directorate of the Central Customs Authority (FVG § 5a(2)) under the Federal Ministry of Finance's supervision (§ 28(2)) |
Five more bodies matter without supervising firms under § 50:
- Federal Ministry of Finance. Coordinates the national risk analysis (§ 3a(2)) and may, by ordinance, entrust a private company with running the Transparency Register (§ 25(1)).
- Deutsche Bundesbank. Outside BaFin's GwG supervision (§ 50 no. 1(a)), yet bound by the KWG safeguards rule (KWG § 25h(6)).
- Public prosecutors. May consent to or ban a reported transaction (§ 46(1)) and bring laundering charges.
- Central Office for Sanctions Enforcement. A second customs directorate (FVG § 5a(2)); traces and secures funds frozen under EU sanctions (SanktDG §§ 1 to 3).
- Former FMSA. The Finanzagentur holds its rights and duties for the tasks moved there and took part of its staff on 1 January 2018 (StFG § 3a(2b), (2c)).
Who must comply with the GwG?
Section 2(1) lists 16 groups of obliged entities, covered when they act in their trade or profession. Nos. 1 to 9 are the financial sector: banks, financial services institutions, investment firms, crypto service providers (CASPs), payment and electronic money institutions and their agents, financial companies, insurers offering life and similar products, their intermediaries and investment management companies, German branches of foreign firms included. Nos. 10 to 16 add lawyers, patent attorneys and notaries for named transactions, other legal advisers, auditors and tax advisers, trust and company service providers, real estate agents, most gambling operators, goods traders and art intermediaries.
Every goods trader is obliged, yet due diligence and risk management start only at the euro lines of § 10(6a) and § 4(5). Picture a Munich gallery selling a painting for €12,000 by bank transfer: an art deal of at least €10,000 needs due diligence however it is paid. The jeweler next door taking €2,500 in cash for a gold bar crosses the €2,000 cash line for precious metals. Paid by card, the same sale does not, absent signs of laundering.
What are the AML and KYC compliance program requirements in Germany?
The table maps 12 duties to their GwG sections. Its last column shows where complead, formerly Sanction Scanner, fits; Sanction Scanner, the screening product, is part of complead. Above the table sit the people the act names:
- Money laundering officer (§ 7). Firms under § 2(1) nos. 1 to 3, 6, 7, 9 and 15 appoint a money laundering officer (Geldwäschebeauftragter) at management level and a deputy. The officer works in Germany and reports directly to management. The supervisor can exempt a firm that meets § 7(2), and can order the other obliged entities to appoint one (§ 7(3)).
- Accountable manager (§ 4(3)). A named member of management answers for compliance and approves the risk analysis and the safeguards.
- Staff (§ 6(2) nos. 5 and 6). Firms check employees' reliability and train them from the start and on an ongoing basis.
| Obligation | Legal basis (GwG in force November 2026, as amended 29 June 2026, unless noted) | What a program must do | How complead does it |
|---|---|---|---|
| Risk management | §§ 4 to 7 | Keep effective risk management: a documented risk analysis reviewed regularly (§ 5), internal safeguards (§ 6), a named manager who approves both (§ 4(3)), and an officer and deputy where § 7(1) applies. | Every rule and threshold change carries a version, the name of whoever made it, the time and the reason, and one click takes it back. |
| Customer due diligence | §§ 10 to 13 | Identify the customer and anyone acting for it, check whether a beneficial owner stands behind it, learn the purpose of the relationship and check PEP status (§ 10(1)); at onboarding, at the § 10(3) euro lines, on facts suggesting laundering or terrorist financing, and on doubts about identity data. Where this cannot be done, start no relationship and run no transaction, and end an existing relationship; lawyers, notaries, auditors and tax advisers giving legal advice or representation are exempt unless they know it is used for laundering or terrorist financing (§ 10(9)). | Onboarding, screening and monitoring feed a single score for each customer; the log of every screening search names who ran it, for which name, when, and what came back. |
| Beneficial owner | § 3, § 10(1) no. 2, § 23a | For an unlisted company, identify the ultimate beneficial owner: each natural person who directly or indirectly holds more than 25 percent of the capital, controls more than 25 percent of the votes or exercises comparable control (§ 3(2)); learn the ownership and control structure; report mismatches found when consulting the Transparency Register for due diligence to the registry "unverzüglich" (without undue delay), which checks them and marks the entry as under review (§ 23a(3), (6)). | KYB and UBO verification traces owners and controlling entities upward with "no fixed depth cap", "until natural persons are reached"; unresolved layers are reported as such, and whether a structure is blocked stays "a determination for your compliance function and counsel". |
| Politically exposed persons | § 1(12) to (14), § 10(1) no. 4, § 15(3) no. 1, (4) | Use risk based procedures to learn whether the customer or its beneficial owner is a PEP, a PEP's family member or a known close associate; get approval from a member of senior management, take measures to establish the source of the assets used and monitor more closely; after the person leaves office, weigh the PEP specific risk for at least 12 months and until it no longer applies. | A PEP match feeds the customer's single score; the approval stays with a person, and the record shows who gave it. |
| Enhanced due diligence | § 15(2), (3), (5) to (7) | Apply enhanced measures wherever risk may be higher, in particular for PEPs, high risk third countries named by the European Commission, transactions that, against similar cases, are especially complex or unusually large, follow an odd pattern or lack an apparent economic or lawful purpose, and, for banks, payment, financial and insurance firms (nos. 1 to 3, 6 to 8), cross border correspondent relationships with respondents in third countries (or in the EEA where the firm assesses higher risk). | Rules are scoped per product, segment or jurisdiction, so customers tied to listed countries run under their own rules. |
| Suspicious activity report | § 43, § 45, § 46, § 47 | Report to the FIU without undue delay, whatever the amount, facts suggesting that an asset comes from a crime that could be a predicate offense of laundering, that it is linked to terrorist financing, or that a customer has not disclosed whether it acts for a beneficial owner (§ 43(1)); report electronically and register with the FIU (§ 45(1)). Hold the transaction until the FIU or the prosecutor consents or the third working day after the report passes without a ban, Saturdays not counted (§ 46(1)); where a hold is impossible or would hinder the prosecution of a suspected crime, it may go ahead and the report follows without undue delay (§ 46(2)). Tell no one, with exceptions such as state bodies and firms of the same financial group (§ 47(2)); lawyers, notaries, auditors and tax advisers who try to talk a client out of an illegal act do not breach the ban (§ 47(4)). Lawyers, notaries, auditors and tax advisers need not report what they learn in legal advice or representation, unless they know the client used it for laundering, terrorist financing or another crime, or the real estate ordinance of § 43(6) applies (§ 43(2)). | Reporting support within case management; agent outputs carry the evidence, a narrative and the work log. |
| Sanctions | EU sanctions regulations; AWG; SanktDG | Freeze the funds of persons on EU sanctions lists, which apply directly, and make no funds available to them; screening customers and payments is how firms find them; German law adds penalties and enforcement powers. | Screening scans 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes, and a search with no match is recorded as well. |
| Monitoring and monitoring systems | § 10(1) no. 5; KWG § 25h(2); ZAG § 27(1) no. 5; § 6(4) | Monitor relationships and transactions on an ongoing basis and keep customer data current at risk based intervals; banks, payment and electronic money institutions and gambling operators also run data processing systems (see below). | A transaction monitoring rule is built without code, and a backtest replays it over a 30, 60 or 90 day window of real history before it ships; an API trigger starts or stops screening of a name. |
| Transfers of funds and crypto transfers | Regulation (EU) 2023/1113; § 6(4a); § 15a | Send payer and payee data with transfers of funds and crypto transfers under the travel rule; CASPs take adequate measures to comply (§ 6(4a)); for a crypto transfer from or to a self hosted address, assess the risk and take at least one risk reducing measure (§ 15a). | While the payment is processed, the API screens the sender and the receiver. |
| No cash in real estate | § 16a; § 59(11) | Accept no cash, crypto assets, gold, platinum or precious stones for the purchase or exchange of German real estate or for shares in companies that hold it, under contracts from 1 April 2023; the notary checks proof of payment before filing for registration (§ 16a(2), (3)), except up to €10,000 or through the notary's escrow account (§ 16a(5)); a notary who has reported may file only after the fifth working day from the report (§ 16a(3) no. 2). | No product step: under § 16a the notary checks the proof of payment. |
| Record keeping | § 8 | Keep CDD data, risk assessment results and the reasons behind each reporting decision (§ 8(1)); for five years, unless another law sets longer, counted for a relationship from the end of the calendar year it ends and otherwise from the end of the year the data was obtained; destroy after ten years at most (§ 8(4)). | The search audit trail keeps the searcher, the name, the time and the result of every check. |
| Training and reliability | § 6(2) nos. 5, 6 | Check staff reliability, for example through personnel controls and appraisals, and train staff at hiring and on an ongoing basis in laundering methods, their duties and data protection. | Closed cases keep the rule that fired and the signals that matched, which gives training real examples from the team's own work. |
Which euro thresholds apply in 2026?
Germany has no general cash cap before July 2027. Euro lines decide when due diligence starts:
- €15,000. Any other occasional transaction outside a business relationship (§ 10(3) no. 2(b)).
- €1,000. Occasional transfers of funds and crypto transfers (no. 2(a), (c)).
- €2,000. Gambling stakes or winnings, online gambling excepted (§ 10(5)); cash paid or received by a goods trader for precious metals (§ 10(6a) no. 1(b)).
- €10,000. Art deals and cash for other goods (§ 10(6a)); brokered rentals from €10,000 net monthly rent, brokered sales at any price (§ 10(6)).
- No cash at all. Real estate under contracts from 1 April 2023 (§ 16a).
Facts suggesting laundering or terrorist financing, or doubts about identity data, trigger due diligence at any amount (§ 10(3) nos. 3, 4).
What monitoring systems must banks, payment institutions and forex dealers run?
Beyond the ongoing monitoring every firm owes (§ 10(1) no. 5), three groups must run data processing systems:
- Credit institutions. Systems that detect relationships and payments that, compared with similar cases, are especially complex or large, run unusually, or have no apparent economic or lawful purpose (KWG § 25h(2)).
- Payment and electronic money institutions. Adequate measures, data processing systems included, to meet the GwG and Regulation (EU) 2023/1113 (ZAG § 27(1) no. 5).
- Gambling operators. Systems that flag doubtful or unusual play and player account activity (GwG § 6(4)).
Currency exchange dealers (Sortengeschäft, KWG § 1(1a) no. 7) are financial services institutions: KWG § 25h(1) safeguards bind them, but the § 25h(2) system duty names credit institutions only. Supervisors may set criteria that let a firm do without systems (KWG § 25h(2), ZAG § 27(3), GwG § 6(4)).
What are the penalties for AML breaches in Germany?
| Breach or offense | Legal basis | Ceiling (in force, November 2026) |
|---|---|---|
| Breaches listed in § 56(1), for example risk analysis, CDD, records, late or missing reports (no. 69), committed intentionally or recklessly | GwG § 56(1) | €150,000 if intentional, €100,000 if reckless |
| No money laundering officer, tipping off (§ 47), carrying out a held transaction and others, committed intentionally or negligently | GwG § 56(2) | €150,000 if intentional, €100,000 if reckless, €50,000 if negligent |
| Breaches of the crypto transfer rules of Regulation (EU) 2023/1113 (the travel rule; arts. 14, 17, 19 to 21 and 26), intentional or negligent | GwG § 56(2a) | €200,000 |
| Serious, repeated or systematic breach (§ 56(1), or intentional or reckless § 56(2), (2a)) | GwG § 56(3) | €1 million or twice the economic benefit |
| Same, by a legal person under § 2(1) nos. 1 to 3 or 6 to 9 | GwG § 56(3) | The higher of €5 million or 10% of total turnover in the business year before the decision |
| Same, by a natural person under § 2(1) nos. 1 to 3 or 6 to 9 | GwG § 56(3) | €5 million |
| Money laundering | StGB § 261(1) | Up to 5 years in prison or a fine |
| Laundering by an obliged entity | StGB § 261(4) | 3 months to 5 years in prison |
| Especially serious case (usually commercial or gang laundering) | StGB § 261(5) | 6 months to 10 years in prison |
| Reckless laundering | StGB § 261(6) | Up to 2 years in prison or a fine |
BaFin fines GwG breaches by the firms it supervises as administrative offenses; Transparency Register offenses (§ 56(1) nos. 54 to 66) go to the Federal Office of Administration (§ 56(5)). Final measures and fines must be published, though § 57(2) delays or anonymizes publication that would harm a person, market stability or an investigation. Prosecutors charge laundering under the Criminal Code. For a parent or subsidiary, turnover means the figure in the consolidated accounts of the widest group (§ 56(4)).
BaFin enforcement, 2024 to 2026
Late suspicious activity reports run through BaFin's fines. J.P. Morgan SE failed to file them without undue delay from October 2021 to September 2022, N26 filed them late in 2022 and VR-Bank Bad Salzungen Schmalkalden during 2023. Orders are the other tool: at CRONBANK, BaFin appointed a special representative (Sonderbeauftragter) to watch the remediation.
| Firm | Date | Measure | Finding | Source |
|---|---|---|---|---|
| J.P. Morgan SE | Final 30 October 2025 (published 6 November 2025) | €45 million fine | Breached supervisory duties over its reporting processes; as a result, suspicious transaction reports were systematically not filed without undue delay, 4 October 2021 to 30 September 2022 | BaFin |
| N26 Bank AG | 21 May 2024 | €9.2 million fine | Suspicious activity reports systematically filed late in 2022 | BaFin |
| VR-Bank Bad Salzungen Schmalkalden eG | Published 20 January 2026 (final 24 December 2025) | €325,000 fine | Breached its supervisory duty over reporting processes; reports systematically not filed on time during 2023 | BaFin |
| DLT Securities GmbH | Published 19 March 2026 (final 18 February 2026) | Three fines, €140,000 in total | Internal safeguards not adequate or updated, at least 1 May 2022 to 18 February 2025; digital customer risk scoring never subjected to a control | BaFin |
| CRONBANK AG | Published 29 May 2026 | Package of orders, special representative, extra own funds | Special audit closed August 2025: serious deficiencies in lending and AML | BaFin |
| Norddeutsche Landesbank (NORD/LB) | Published 3 August 2026 (final 14 June 2026) | Order to remedy | Process deficits and a large backlog in updating customer data | BaFin |
How do screening and monitoring meet the GwG?
Picture a BaFin special inspection at a Frankfurt payment institution. The inspector picks one customer and asks for the screening result at onboarding, the alert that fired months later, who closed it and why, and the day the report reached the FIU. Section 8(1) no. 5 makes the firm record its reasoning on every reporting assessment, whichever way it goes, and § 8(4) keeps that record for five years.
Client screening and ongoing monitoring answers the first request with a log of who searched, which name, when and with what result, no match results included. Each search consults 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. Per list type, or per single list, fuzzy matching thresholds can differ, so a sanctions list can run lower than a watchlist. An API trigger starts monitoring of a name and stops it once the name no longer matters.
For the payment flow, transaction monitoring rules are written without code and tried on 30, 60 or 90 days of history first. KWG § 25h(2) makes banks keep their systems up to date, and the version log shows when each rule changed, who changed it and why. On complead, agents close the routine cases, and each closure comes with the evidence, a narrative and a work log. Every alert shows which rule fired and which signals matched. Your analysts decide the cases that need judgment. The record shows who did.
What is new in German AML law since 2025, and what arrives in 2027?
- 30 October 2025. BaFin's €45 million fine on J.P. Morgan SE becomes final.
- 29 May 2026. BaFin publishes final CRONBANK orders, special representative included.
- 29 June 2026. Latest GwG amendment (Art. 12(4) of the law of that day).
- 10 July 2026. Articles 11, 12, 13 and 15 of AMLD6, Directive (EU) 2024/1640, on register access, fall due (art. 78(1)).
- 3 August 2026. BaFin publishes its customer data order at NORD/LB.
- 30 September 2026. The customs and financial crime bill reaches the Bundestag (Drucksache 21/8282). It restructures customs, adds data exchange for state AML supervisors and works on Transparency Register data with AMLD6 articles 11 to 15 in view.
Next: if adopted, the bill applies mostly from 1 January 2027 (art. 24(1)), its first GwG amendment (art. 18) the day after promulgation (art. 24(2)). By 1 January 2027, goods traders in lines other than art, jewelry, watches, precious metals and stones, motor vehicles, ships, motorboats and aircraft register with the FIU too (§ 45(1), § 59(6)).
AMLA selects the entities it will supervise directly in 2027. Regulation (EU) 2024/1620 seats it in Frankfurt (art. 4) and starts direct supervision from 2028 (recital 86).
On 10 July 2027 the EU AML Regulation applies to most obliged entities (art. 90), and its art. 80 caps cash paid or accepted for goods and services at €10,000. The bulk of AMLD6 falls due the same day.
Back to BaFin's 75 special inspections: three checks follow from the cases above. Time last quarter's suspicious activity reports from alert to filing, because late filing is what drew the fines on J.P. Morgan SE, N26 and VR-Bank. Send each Transparency Register mismatch found in a KYB check to the registry as a discrepancy report (§ 23a). Then map each GwG section in your policies to its AMLR article; the free EU AMLR customer due diligence form lists an AMLR article next to most of its 54 questions.
The 2026 PDF. The 16 page PDF from the form beside this article adds the working papers: fourteen program checks with the GwG section behind each, an illustrative German customer risk factor template and a decision record for suspicious activity reports.
