Anti-Money Laundering Duties Under the GwG

Who is an obliged entity under the GwG

Anti money laundering obligations in Germany are set out in the Money Laundering Act (Geldwäschegesetz, GwG). The Act applies to obliged entities (Verpflichtete) listed in § 2(1) GwG when they act in the course of their business or profession (§ 2(1) GwG).

The list goes far beyond banks. It covers credit institutions, financial services institutions, investment firms, crypto-asset service providers, payment and e-money institutions and their agents, financial undertakings, life insurers and insurance intermediaries, capital management companies, lawyers, patent attorneys and notaries when they participate in certain transactions, tax advisers and auditors, trust and company service providers, real estate agents, gambling operators and traders in goods, including art dealers.

The anti money laundering regime is risk-based: each obliged entity must understand its own exposure to money laundering and terrorist financing and apply proportionate measures. Supervision is fragmented. BaFin supervises the financial sector, professional chambers supervise lawyers, notaries, tax advisers and auditors, and the authorities of the federal states supervise non-financial businesses such as real estate agents and goods traders. The Financial Intelligence Unit (FIU), the Central Office for Financial Transaction Investigations, receives suspicious activity reports.

Anti money laundering risk management and internal safeguards

Obliged entities must have effective risk management appropriate to the nature and scale of their business, consisting of a risk analysis and internal safeguards (§ 4 GwG). A member of senior management must be appointed as responsible for risk management. The risk analysis identifies and assesses the money laundering and terrorist financing risks of the business, taking into account the risk factors in the annexes to the GwG and the national risk assessment, and must be documented, reviewed regularly and updated (§ 5 GwG).

Internal safeguards are principles, procedures and controls that manage and mitigate the identified risks (§ 6 GwG). They include internal policies, customer due diligence procedures, reporting procedures, record-keeping, reliability checks on employees, training and an independent audit function where appropriate. Financial sector entities, and certain others, must appoint an anti money laundering officer at management level and a deputy (§ 7 GwG); the officer is responsible for compliance with anti money laundering rules, but management remains ultimately responsible. Supervisory authorities can also order other obliged entities to appoint an officer.

Customer due diligence

General due diligence duties include identifying the contracting party and any person acting on its behalf, establishing whether the customer acts for a beneficial owner and identifying that person, obtaining information on the purpose and nature of the business relationship, determining whether the customer or beneficial owner is a politically exposed person and monitoring the relationship continuously (§ 10(1) GwG). The duties apply when establishing a business relationship, for occasional transactions above statutory thresholds, when there are indications of money laundering or terrorist financing and when there are doubts about identification data.

Enhanced due diligence is required where the risk analysis or the individual case shows higher risk, in particular for politically exposed persons, transactions involving high-risk third countries identified by the European Commission and unusually complex or large transactions without an apparent economic purpose (§ 15 GwG). Measures include senior management approval of the relationship, establishing the source of funds and wealth and enhanced monitoring. Simplified due diligence is possible where the risk is demonstrably low.

Due diligence may in certain cases be performed by third parties, such as other obliged entities in the EU, and the results relied on, but the obliged entity remains responsible. Outsourcing of due diligence tasks to service providers, for example video identification providers or know-your-customer platforms, requires a contract, adequate control and, for financial institutions, notification to the supervisor where the rules on outsourcing apply.

Where an obliged entity cannot complete due diligence, it must not establish or continue the business relationship and must not carry out the transaction; if it already exists, the relationship must be terminated. This rule is strictly enforced and is often the decisive point in difficult onboarding cases, for example where a customer refuses to disclose its ownership structure or the origin of the funds involved.

Beneficial owners and the transparency register

Legal persons under private law and registered partnerships must obtain, keep up to date and report information on their beneficial owners to the transparency register (§ 20(1) GwG); foreign entities holding German real estate are also covered. Obliged entities must consult the register when establishing business relationships with such entities, but may not rely on it alone, and must report discrepancies between register entries and their own findings. For corporate groups and investment structures, identifying the beneficial owners through several layers of ownership and control often requires significant effort.

Non-financial businesses, groups and record-keeping

Outside the financial sector, anti money laundering compliance is often less mature than in banks, even though the duties are just as binding.

Real estate agents, including those arranging leases above a monthly rent threshold, must identify both parties to the transaction. Traders in goods are obliged entities generally, but several duties are triggered only when they make or receive cash payments above thresholds set in the GwG, with lower thresholds for particularly sensitive goods such as precious metals and art. Notaries play a central role in real estate and company transactions and must refuse to act where the beneficial ownership of a buyer cannot be established in the cases specified by the Act.

Groups must implement group-wide measures. A parent company that is itself an obliged entity must carry out a group-wide risk analysis and ensure that subsidiaries and branches apply equivalent measures, including group policies on information sharing for anti money laundering purposes, unless local law prevents this. For international groups with German subsidiaries, the German entity must comply with the GwG even if group standards differ, and conflicts between group policies and German requirements should be resolved in favour of the stricter standard.

Records of due diligence measures, including copies of identification documents, information on beneficial owners and the results of risk assessments, must be kept for the statutory retention period and then deleted. Electronic identification and video identification procedures are permitted under conditions specified by supervisors, which matters for digital onboarding. Weaknesses in record-keeping are a frequent finding in audits, because they make it impossible to demonstrate that due diligence was performed at all.

Suspicious activity reports and the standstill

If facts indicate that an asset connected with a business relationship or transaction derives from a criminal offence that could be a predicate offence for money laundering, or is connected with terrorist financing, or that the customer has not disclosed whether it acts for a beneficial owner, the obliged entity must report to the FIU without delay, regardless of the value involved (§ 43(1) GwG).

The threshold is low: a suspicion based on facts suffices, and certainty is not required. Lawyers, notaries, tax advisers and auditors are exempt where the information relates to legal advice or representation in proceedings, unless they know that the client is using the advice for money laundering.

A reported transaction may generally be executed only once the FIU or the public prosecutor has consented or after the third working day following the report without a prohibition (§ 46(1) GwG). Obliged entities must not tell the customer about the report (tipping-off prohibition). Reports are filed electronically through the FIU's reporting system, and obliged entities need procedures to decide quickly, document decisions and handle the standstill in practice.

Supervision and sanctions

Breaches of the GwG are administrative offences. Fines of up to EUR 1 million or up to twice the economic benefit gained can be imposed for serious, repeated or systematic breaches.

For credit institutions and financial institutions that are legal persons, fines can reach EUR 5 million or 10 per cent of total annual turnover (§ 56 GwG). Supervisory authorities publish final sanctions, and BaFin can appoint special representatives to monitor the implementation of anti money laundering measures in financial institutions. Criminal liability for money laundering itself under § 261 of the Criminal Code is separate and can affect individuals and, through corporate fines, companies; see our page on white-collar crime and corporate defence.

The EU anti money laundering package and the road to 2027

The EU has adopted a new anti money laundering package: the Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, which will apply directly from 10 July 2027 (with later application in 2029 for certain football-related entities) (Regulation (EU) 2024/1624), a sixth directive on supervision and FIUs, and a regulation establishing the EU Anti-Money Laundering Authority (AMLA).

The AMLR will replace much of the GwG's substantive content with a single EU rulebook on due diligence, beneficial ownership and reporting, and introduces an EU-wide limit on large cash payments for goods and services of EUR 10,000, with member states free to set lower limits. AMLA will directly supervise selected high-risk financial institutions and coordinate national supervisors.

For German obliged entities, the transition means reviewing policies and systems against the AMLR well before July 2027. Some German specifics, such as the scope of obliged entities in the non-financial sector and the organisation of supervision, will need to be adapted by national legislation. Our insight on MiCAR CASP authorisation covers crypto-specific obligations, including the travel rule.

How TRW & Co helps

We advise banks, fintechs, payment and crypto firms, insurers, fund managers, real estate businesses and goods traders on anti money laundering compliance under the GwG. We prepare and review risk analyses and internal safeguards, design due diligence and transparency register processes, train management and staff, advise on suspicious activity reports and support clients in supervisory audits and sanction proceedings. We also prepare clients for the AMLR and AMLA, together with our compliance management systems team. This page is general information, not legal advice. To discuss your obligations, please contact us.