Social Lease GmbH: Bafin setzt Bußgeld fest

The order became final on 1 October 2026 following findings in March 2025. Although the monetary penalty is modest, the case reinforces that German supervisors expect financial services firms to maintain documented, risk-based AML frameworks—not merely written policies. Compliance teams should treat this as a targeted reminder to test whether their AML/CFT internal controls are proportionate to their customer, product and geographic risk profiles.

Priority checks include: up-to-date AML risk assessments; clear policies and procedures for customer due diligence and ongoing monitoring; effective controls and escalation routes; board-level accountability; staff training; and evidence of testing and remediation. Firms should also verify that group-wide or outsourced arrangements do not leave gaps in customer-related safeguards. The enforcement action does not create new obligations, but it signals continued supervisory attention to AML governance.

A short internal review can help identify remediation needs before a supervisory inspection, reduce the risk of fines and reputational damage, and demonstrate good faith to regulators. For smaller or niche financial services providers, proportionate but evidenced controls are likely to be the key supervisory expectation.