Illustrative firm examples
Germany country research brief
Research dated 2026-10-10 · Reviewed 2026-10-10
Version 77226f03f1e3
77226f03f1e30c6bb718458ebae4610b9a38a87d815f091cd85bc3995ef6ea59Scope: Illustrative firm examples. The selector is not an authorisation or legal-applicability determination. Source-check observations concern retrieval/access only and do not establish legal currentness; the research date is the content date boundary. Source health: review-required, checked 2026-10-12T05:36:08.981Z.
Framework and authorities
Defined duties and divided supervision
Under Germany's Money Laundering Act (GwG), duties apply to entities and activities listed in § 2, not to every company or merely because a profile label fits. The Act of 29 June 2026 amended specified GwG provisions; Article 13(1) sets its general commencement on 1 September 2026. GwG § 50 allocates supervision by category. BaFin supervises specified financial-sector categories; the full Länder and other-supervisor map is outside this brief. The Financial Intelligence Unit (FIU) receives and analyses reports under GwG §§ 27-32.
Three selected, reviewed GwG duties
These examples are three reviewed provisions in the 75-unit public GwG register, not the complete German or EU anti-money-laundering framework. For an actual entity, check whether § 2 covers its activities and verify applicable thresholds, cross-references and exceptions.
Risk, FATF and sanctions context
Dated national risk evidence
The 2026 sector risk report from the Federal Ministries of Finance and Justice uses evidence through June 2026 on money laundering (ML) involving legal persons and arrangements, and related terrorist financing (TF). It says GmbHs were often misused in observed cases but are not inherently risky; targeted TF use of legal entities is assessed low across forms in this report. Proliferation financing (PF) is outside its scope. Separately, a December 2023 Finance Ministry report says the Financial Action Task Force (FATF) plenary revised the technical-compliance ratings for Recommendations 6 and 7 from partially compliant (PC) to largely compliant (LC). This is a dated technical-compliance change, not an effectiveness result or current list position. Current FATF list status remains unverified because the official list originals could not be retained.
Sanctions and jurisdictional nexus
Germany's Foreign Trade and Payments Act (AWG) is part of the national framework, not a complete sanctions catalogue. For EU measures, identify the applicable regulation, covered persons and territory, ownership/control rules, prohibitions, licences and reporting terms; no live list or designation was checked. German presence alone does not establish UK or U.S. sanctions scope. A cross-border payment alone is not enough to decide either: assess the relevant persons, transaction and other connections under each regime's own rules.
Selected firm implications
Meaning: An obliged entity must identify and assess its money-laundering (ML) and terrorist-financing (TF) risks, consider Annexes 1-2 and national-risk information, document the analysis, review it regularly and update it when necessary, and provide it to its supervisor on request. A parent undertaking assesses the group as a whole.
Conditions: Only an entity obliged under GwG § 2 and within the applicable § 4 risk-management perimeter; activity- and threshold-limited categories remain limited by § 4(4)-(5).
Exceptions: Under § 5(4), the supervisor may waive documentation only on application and evidence that concrete risks in the relevant area are clearly identifiable and understood. Risk identification and assessment remain required.
Suggested action: Assess the obliged entity's actual business risks, record the analysis and keep it under review.
Legislation / Binding · § 5Meaning: Customer due diligence (CDD) triggers at relationship start; specified occasional transfers of EUR 1,000 or more under the EU Transfer of Funds Regulation; other transactions of EUR 15,000 or more; crypto transfers of EUR 1,000 or more; and suspicion or identity doubt at any amount. Identify the customer and, where applicable, their representative and verify that person's authority. Determine whether the customer acts for a beneficial owner and identify that owner where applicable. Understand purpose, assess politically exposed person (PEP) status where relevant, and monitor. Failure of measures 1-4 generally bars starting or continuing the relationship or transaction under § 10(9).
Conditions: GwG § 2 obliged entities; use the transaction, customer and sector-specific triggers in § 10, not a generic bank/product label. Separate rules cover existing customers and listed sectors.
Exceptions: § 10(9)'s narrow advice/litigation exception covers § 2(1) nos. 10 and 12 unless the firm knows of deliberate ML/TF use. Check specific e-money and gambling/sector branches; suspicion and identity-doubt triggers remain.
Suggested action: Identify the relevant parties, understand purpose and ownership, and monitor when a statutory customer due diligence (CDD) trigger applies.
Legislation / Binding · § 10Meaning: Report where facts indicate: an asset linked to a relationship, brokerage or transaction may derive from a predicate offence; an event, transaction or asset relates to TF; or the counterparty failed the specified § 11(6) beneficial-owner disclosure. No value threshold applies. A separate management-level duty covers a German branch matter concerning its activity.
Conditions: The reporter must be an entity obliged under § 2 and facts must meet one of the three § 43(1) triggers. The clock is without delay; no monetary threshold applies.
Exceptions: For § 2(1) nos. 10 and 12, information received through legal advice/litigation is excepted unless the professional knows it is used for an offence or § 43(6) applies. The German-branch duty remains; § 43 adds no separate crypto trigger.
Suggested action: Submit a qualifying § 43 report to the FIU without delay and irrespective of amount.
Legislation / Binding · § 43Notices and limitations
- Illustrative bank, payments and crypto examples, not an assessed firm profile.
- Product/customer exposure alone is not statutory applicability. This is not a licensing guide.
- Local entity / domestic activity selected.
- 3 representative obligations; see the full register for other duties.
- Source observations are unavailable, stale, failed or review-required. This dated brief does not confirm today's legal position.
- GwG currentness: official 10 Oct fetch matches the retained 27 Sep bytes; identified 29 Jun 2026 Act took effect 1 Sep. No complete amendment or sector-rule audit.
- FATF: BMF provides dated 2023 technical-compliance evidence only. Direct FATF follow-up and Feb 2026 list originals returned HTTP 403; no current-list claim is made.
- The 2026 national risk volume covers legal persons/arrangements, ML and TF; it excludes PF and is not a firm/customer rating.
- BaFin AuA original and full supervisor map remain unavailable. No live FIU workflow, sanctions list, designation, ownership/control case or licence was checked.
- Selected GwG examples only; profile tags do not establish legal scope. English is independent paraphrase, not legal advice or a source translation.
Evidence sources
Original source documents are not reproduced in this brief. Retained originals are private research evidence; use the official-source links.
- Official Legislation Original · Federal Ministry of Justice · Full consolidation; same bytes as 27 Sep capture; amended by Act of 29 Jun 2026, BGBl I No. 197 · GwG §§ 2, 4-5, 10-11, 27-32, 43, 45, 50; Annexes 1-2
- Official Legislation Original · Federal Law Gazette / recht.bund.de · Complete promulgated PDF; Article 12(4) amendment effective 2026-09-01 under Article 13(1) · Article 12(4), amendments to GwG §§ 2(1) no. 12 and 50 no. 7a; Article 13(1), general commencement on 2026-09-01
- Official Supervisory Information · Federal Financial Supervisory Authority (BaFin) · Official BaFin overview captured 2026-10-10; guidance/navigation context, not a complete supervisor allocation · AML supervision overview and linked reporting/guidance materials
- Official National Risk Assessment · Federal Ministry of Finance and Federal Ministry of Justice and Consumer Protection · Complete 131-page German original; report states information current to June 2026; PDF metadata creation 20 July 2026 · Executive Summary; §§ 1-3 and 6; Annex A (methodology), Annex B (register data), Annex C (suspicious reports), including tables/notes
- Official Legislation Original · Federal Ministry of Justice / gesetze-im-internet.de · Official full HTML retrieved 2026-10-10; retained page identifies the 3 February 2026 amending Act; a partial national framework, not the full restrictive-measure set · Selected statutory framework, including §§ 4-6 and 18; complete consolidation retained
- Official Government Report · Federal Ministry of Finance, BMF Monthly Report December 2023 · Complete 4-page article, printed pp. 46-49; October 2023 plenary account · Full article pp. 46-49; re-rating evidence pp. 47-48; p. 49 proposed legislation only, not current law; not current-list evidence
- Official Sanctions Guidance · European Commission · Official Commission page captured 2026-10-09; shared retained original reused from the existing brief evidence fixture · How to identify and read the EU restrictive-measure instrument applicable to a case
- Official Foreign Sanctions Guidance · HM Treasury, Office of Financial Sanctions Implementation · Official guidance updated 2026-05-12; shared retained original reused from the existing brief evidence fixture · Territorial and person scope; ownership/control; assess the particular regime nexus
- Official Foreign Sanctions Guidance · U.S. Department of the Treasury, Office of Foreign Assets Control · Official FAQ page captured 2026-10-09; shared retained original reused from the existing brief evidence fixture · FAQ 11: U.S.-person and territorial scope; no automatic German nexus inferred
GwG, retrieved 10 Oct 2026
Full consolidation; same bytes as 27 Sep capture; amended by Act of 29 Jun 2026, BGBl I No. 197 · GwG §§ 2, 4-5, 10-11, 27-32, 43, 45, 50; Annexes 1-2
Source record
Retrieved 2026-10-10T05:58:58Z. SHA-256: 46dd79795a15c9bf3dbeb69926c497cd2f53de7dd823cd70476378d7784f6852
Source retrieval check
failed · Checked 2026-10-12T05:35:12.631Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
BGBl. 2026 I No. 197, Art. 12(4)
Complete promulgated PDF; Article 12(4) amendment effective 2026-09-01 under Article 13(1) · Article 12(4), amendments to GwG §§ 2(1) no. 12 and 50 no. 7a; Article 13(1), general commencement on 2026-09-01
Source record
Retrieved 2026-10-10T06:00:36Z. SHA-256: 0ac9f7d5f47a69f15bb30645f3570d54dbea88ec359662c1a26f02db4c854462
Source retrieval check
observed · Checked 2026-10-12T05:35:38.131Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
BaFin AML overview, captured 10 Oct 2026
Official BaFin overview captured 2026-10-10; guidance/navigation context, not a complete supervisor allocation · AML supervision overview and linked reporting/guidance materials
Source record
Retrieved 2026-10-10T05:59:31Z. SHA-256: 31a783b0b40e2934a4ef9441544025c73babdba7f8609e7254c796996a472060
Source retrieval check
review-required · Checked 2026-10-12T05:35:38.686Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
National risk analysis sector volume, June 2026
Complete 131-page German original; report states information current to June 2026; PDF metadata creation 20 July 2026 · Executive Summary; §§ 1-3 and 6; Annex A (methodology), Annex B (register data), Annex C (suspicious reports), including tables/notes
Source record
Retrieved 2026-10-10T05:59:03Z. SHA-256: 2781227af544527afe577f50920d8c9fdbd16730839f726c1266a3b843e7f5f9
Source retrieval check
observed · Checked 2026-10-12T05:35:40.495Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
AWG, retrieved 10 Oct 2026
Official full HTML retrieved 2026-10-10; retained page identifies the 3 February 2026 amending Act; a partial national framework, not the full restrictive-measure set · Selected statutory framework, including §§ 4-6 and 18; complete consolidation retained
Source record
Retrieved 2026-10-10T05:59:36Z. SHA-256: b5ad6de2389eba0452d53d6126affb52bd89c8c7801aec04499b4c97c32f5ef9
Source retrieval check
failed · Checked 2026-10-12T05:35:41.124Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
BMF Monthly Report, Dec 2023, pp. 46-49
Complete 4-page article, printed pp. 46-49; October 2023 plenary account · Full article pp. 46-49; re-rating evidence pp. 47-48; p. 49 proposed legislation only, not current law; not current-list evidence
Source record
Retrieved 2026-10-10T06:05:22Z. SHA-256: feebb87613b229119a8715670d4f5c1e5ae94dd82f8e1f8ffa513b9f70e189dd
Source retrieval check
observed · Checked 2026-10-12T05:36:06.626Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
EU sanctions overview, captured 9 Oct 2026
Official Commission page captured 2026-10-09; shared retained original reused from the existing brief evidence fixture · How to identify and read the EU restrictive-measure instrument applicable to a case
Source record
Retrieved 2026-10-09T19:54:30Z. SHA-256: 84d90e3b6d3d7ca27c33d98783660ea6e86c7f837a8006418763b4e96dab98c4
Source retrieval check
review-required · Checked 2026-10-12T05:36:07.111Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
OFSI scope, updated 12 May 2026
Official guidance updated 2026-05-12; shared retained original reused from the existing brief evidence fixture · Territorial and person scope; ownership/control; assess the particular regime nexus
Source record
Retrieved 2026-10-09T20:24:30.136Z. SHA-256: 254c2891db0f511d40d8bf862d92954c08469ae8c7f720dbd9b613b551e9c230
Source retrieval check
review-required · Checked 2026-10-12T05:36:07.976Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
OFAC FAQ 11, updated 21 Aug 2024
Official FAQ page captured 2026-10-09; shared retained original reused from the existing brief evidence fixture · FAQ 11: U.S.-person and territorial scope; no automatic German nexus inferred
Source record
Retrieved 2026-10-09T19:54:40Z. SHA-256: 92cfe8932dd817a5c2371d265ae1ecbaf62970f798c0d5c6ab77fd96897e0e99
Source retrieval check
review-required · Checked 2026-10-12T05:36:08.981Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-10.
This brief relies on the identified official source edition. Open it using the official-source control.
Retail bank
Meaning
An obliged entity must identify and assess its money-laundering (ML) and terrorist-financing (TF) risks, consider Annexes 1-2 and national-risk information, document the analysis, review it regularly and update it when necessary, and provide it to its supervisor on request. A parent undertaking assesses the group as a whole.
Full public provision explanation
An obliged entity subject to the applicable §4 risk-management perimeter must assess risks arising from the business it actually conducts, use the statutory annex factors and national-risk information, document the assessment, keep it under regular review, update when needed and produce the current version if its supervisor asks. A parent undertaking assesses its whole group. Only the documentation step can be waived, and only after an application and a supervisory finding that the concrete risks are clear and understood.
Suggested action
Assess the obliged entity's actual business risks, record the analysis and keep it under review.
Conditions
Only an entity obliged under GwG § 2 and within the applicable § 4 risk-management perimeter; activity- and threshold-limited categories remain limited by § 4(4)-(5).
- Applies to obliged entities subject to the risk-management system under §4, including the activity- and threshold-limited §4(4)-(5) perimeter for real-estate agents and goods/art businesses. Assess risks arising from the business actually conducted, use Annexes 1 and 2 and national-risk information, and cover the group as a whole where the obliged entity is a parent undertaking. The authority may request the current version.
Exceptions
Under § 5(4), the supervisor may waive documentation only on application and evidence that concrete risks in the relevant area are clearly identifiable and understood. Risk identification and assessment remain required.
- Under §5(4), the supervisory authority may, on the obliged entity's application, waive documentation only if the entity demonstrates that the concrete risks in the relevant area are clearly identifiable and understood. The risk identification and assessment remain required.
Payments and e-money
Meaning
Customer due diligence (CDD) triggers at relationship start; specified occasional transfers of EUR 1,000 or more under the EU Transfer of Funds Regulation; other transactions of EUR 15,000 or more; crypto transfers of EUR 1,000 or more; and suspicion or identity doubt at any amount. Identify the customer and, where applicable, their representative and verify that person's authority. Determine whether the customer acts for a beneficial owner and identify that owner where applicable. Understand purpose, assess politically exposed person (PEP) status where relevant, and monitor. Failure of measures 1-4 generally bars starting or continuing the relationship or transaction under § 10(9).
Full public provision explanation
At onboarding and when statutory triggers arise, the obliged entity must identify the customer and representative, determine whether the customer acts for a beneficial owner, including whether the relationship or transaction is at another person's instigation, and, where the customer is not a natural person, make reasonable inquiries into its ownership and control structure. It must understand the relationship's purpose, determine PEP/family/close-associate status and monitor activity against the customer and beneficial owner's profiles and, where necessary, asset source. The depth is risk-based but must be explainable to the supervisor. Separate thresholds apply to one-off transfers and transactions, gaming, cash-handling payment firms, real-estate agents, goods/art businesses and cash insurance premiums. The cash-taking payment-services rule in §10(4) requires measures 1-2 for that activity without excluding independently triggered measures; §10(7)'s distinct e-money limitation remains as written. If core identification or related checks cannot be completed, the firm must not start or continue the relationship or transaction, subject to the expressly stated legal-advice exception.
Suggested action
Identify the relevant parties, understand purpose and ownership, and monitor when a statutory customer due diligence (CDD) trigger applies.
Conditions
GwG § 2 obliged entities; use the transaction, customer and sector-specific triggers in § 10, not a generic bank/product label. Separate rules cover existing customers and listed sectors.
- The general rules apply to obliged entities under §2(1). CDD is due at relationship establishment; outside a relationship for money transfers under Art. 3(9) of Regulation (EU) 2023/1113 at EUR 1,000 or more, other transactions at EUR 15,000 or more, and crypto-asset transfers worth EUR 1,000 or more; whenever facts indicate ML/TF regardless of exemptions/thresholds; and whenever identity doubts arise. New customers are always covered; existing customers are reviewed at appropriate risk-based times, particularly on material changes or the specified beneficial-owner/tax-law contact duty. For §2(1) nos. 3-5 accepting cash in payment services, §10(4) requires the general CDD measures in §10(1) nos. 1-2 for that activity; this does not displace independently triggered duties under §10(3), including relationship, suspicion/ML-TF and identity-doubt triggers. Entities under §2(1) nos. 4 and 5 acting in the issuance of e-money are separately subject to the limited rule expressly stated in §10(7). For §2(1) no. 15 gambling, the threshold is player winnings/stakes of EUR 2,000 or more. For §2(1) no. 14 real-estate agents, sales brokerage is covered and rental/lease brokerage is covered at monthly net rent of at least EUR 10,000. For §2(1) no. 16, goods/art activity thresholds are art worth EUR 10,000, cash in specified high-value goods EUR 2,000, other goods cash EUR 10,000, or art intermediary/warehouse transactions EUR 10,000. In-house legal/tax advice under subsection (8a) allocates paragraph 1 duties to the employing undertaking when it is itself obliged.
Exceptions
§ 10(9)'s narrow advice/litigation exception covers § 2(1) nos. 10 and 12 unless the firm knows of deliberate ML/TF use. Check specific e-money and gambling/sector branches; suspicion and identity-doubt triggers remain.
- Subsection (5)'s EUR 2,000 gambling trigger does not apply to gambling offered or intermediated online; the physical-venue alternative permits identity checks at entry only if transactions can be attributed to the player. Entities under §2(1) nos. 4 and 5 acting in the issuance of e-money apply only §10(1) nos. 1 and 4 as modified by Banking Act §25i(1), with §25i(2) and (4) also applying. Insurance intermediaries under no. 8 report to the insurer only when collected cash premiums exceed EUR 15,000 in the calendar year. Under subsection (9), if measures 1-4 cannot be completed, business must be refused/ended; for §2(1) nos. 10 and 12, that refusal/termination rule does not apply to legal advice or litigation representation unless the firm knows the service is deliberately used for ML/TF. The notary-specific refusal rule applies while the specified beneficial-owner/entity/trustee notices remain outstanding. Thresholds do not displace the suspicion and identity-doubt triggers in subsection (3) nos. 3-4.
Crypto and digital assets
Meaning
Report where facts indicate: an asset linked to a relationship, brokerage or transaction may derive from a predicate offence; an event, transaction or asset relates to TF; or the counterparty failed the specified § 11(6) beneficial-owner disclosure. No value threshold applies. A separate management-level duty covers a German branch matter concerning its activity.
Full public provision explanation
Report to the FIU without delay when facts indicate that an asset connected with a relationship, brokerage transaction or transaction may derive from a money-laundering predicate offence; that a business event, transaction or asset relates to terrorist financing; or that the counterparty has not fulfilled its section 11(6) sentence 3 beneficial-owner disclosure duty. Reporting does not depend on the asset value or transaction amount. Tell the FIU with the report if a criminal complaint or application for prosecution is also made. A management-level member must report where the obliged entity has a German branch and the matter relates to that branch's activity. The legal-advice/litigation exception is limited to section 2(1) nos. 10 and 12 and is overridden by actual knowledge of use for money laundering, terrorist financing or another offence, or a subsection (6) case. Subsections (5) and (6) permit FIU typologies and a real-estate reporting ordinance; the actual typologies, ordinance and section 261(8) StGB consequences remain separate unreviewed dependencies, not an invented crypto-specific trigger.
Suggested action
Submit a qualifying § 43 report to the FIU without delay and irrespective of amount.
Conditions
The reporter must be an entity obliged under § 2 and facts must meet one of the three § 43(1) triggers. The clock is without delay; no monetary threshold applies.
- An obliged entity with facts indicating any of section 43(1)'s three triggers: possible predicate-offence asset provenance, terrorist-financing connection, or failure of the section 11(6) sentence 3 beneficial-owner disclosure. No value threshold applies. Section 43(3) separately addresses a management-level member where a German branch exists and the matter concerns its activity.
Exceptions
For § 2(1) nos. 10 and 12, information received through legal advice/litigation is excepted unless the professional knows it is used for an offence or § 43(6) applies. The German-branch duty remains; § 43 adds no separate crypto trigger.
- Section 2(1) nos. 10 and 12 need not report information received through legal advice or litigation representation unless they know the client used or uses it for money laundering, terrorist financing or another offence, or a subsection (6) case applies. Actual FIU typologies under (5), the real-estate ordinance under (6) and StGB section 261(8) consequences are not independently analysed here. No special crypto trigger is established by this section.