The Draft Bill is a so-called umbrella act (Artikelgesetz) which amends a number of laws, repeals the current German Anti-Money Laundering Act (Geldwäschegesetz—GwG) and replaces it with a new core statute, the Money Laundering Combating Act (Geldwäschebekämpfungsgesetz—GwBG; in its draft form GwBG-E).
Structurally, the bulk of the substantive obligations for obliged entities—in particular customer due diligence, risk management and reporting requirements—is set out in the AMLR, which applies directly and, apart from a few options and discretions, without national transposition, so that these matters can no longer be regulated in national law.
In light of this, the GwBG-E implements primarily provisions of the AMLD6, including on national risk assessments, transparency registers, the Financial Intelligence Unit (Zentralstelle für Finanztransaktionsuntersuchungen—FIU), and the organization of supervisory authorities, but also makes use of options and discretions provided for under the AMLR.
The legislator’s approach to implementation of the EU framework
The BMF describes the Draft Bill as a 1:1 implementation of the European framework, while the accompanying explanatory memorandum (the Explanatory Memorandum) explains that opening clauses have been used in a risk-based manner and that proven national instruments are retained. Some examples of requirements that go beyond what EU law strictly requires are set out below.
Key takeaways for obliged entities in the financial sector
This briefing provides an initial overview of the changes under the GwBG-E that are relevant to financial sector entities. It does not address general requirements that apply equally to all obliged entities.
- Scope of obliged entities: The scope of obliged entities for the financial sector will follow primarily from Art. 3 AMLR. New obliged entities with relevance for the financial sector in the broader sense include, in particular, crowdfunding service providers and intermediaries and non-financial mixed holding companies.
- Requirements in relation to MLRO/deputy MLRO: The requirement that the Money Laundering Reporting Officer (Geldwäschebeauftragter—MLRO)/deputy MLRO performs the function “in” Germany will no longer apply, and the GwBG-E no longer explicitly regulates the appointment of a deputy MLRO. Prior notification of the appointment to the supervisor is retained.
- Extended requirements for automated account access systems for financial information: The data set for the automated account retrieval system will be significantly expanded (full AMLR identification data, virtual IBANs, and crypto-asset accounts) and connected to the EU-wide BARIS system. This will require substantial IT and data projects.
- Supervision by Bafin as NCA: The Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungs-aufsicht—Bafin) remains the supervisor for entities in the financial sector, unless they are among the up to 40 entities to be initially directly supervised by the Anti-Money Laundering Authority (AMLA). Also, the GwBG-E implements the option under which certain entities operating in a cross-border context are required to establish a central contact point for Bafin.
A closer look at the GwBG-E
Scope of obliged entities
Under the current GwG, the circle of obliged entities is defined nationally in Sec. 2 GwG. From July 10, 2027, it will follow primarily from Art. 3 AMLR, bringing new entities into scope of AML obligations, including crowdfunding service providers and intermediaries and non-financial mixed holding companies. Conversely, traders in goods will only be covered to a much more limited extent than today, and other entities such as central counterparties will no longer be obliged entities.
Based on Art. 3(7) AMLD6, member states may continue to apply the AMLR to entities that qualified as obliged entities under national law prior to July 9, 2024. Sec. 3 GwBG-E makes use of this option to designate further obliged entities: institutions that conduct only deposit business without being credit institutions within the meaning of Regulation (EU) 575/2013 (Capital Requirements Regulation—CRR), institutions underwriting exclusively financial instruments in the sense of the German Banking Act (Kreditwesengesetz—KWG) that are not financial instruments in the sense of Directive 2014/65/EU (Markets in Financial Instruments Directive—MiFID II), and institutions providing qualified crypto custody or crypto securities registry management will continue to be obliged entities, and the AMLR will apply to them in full.
The Explanatory Memorandum justifies this approach with a risk assessment involving Bafin, the FIU, and law enforcement authorities which concluded that these institutions remain exposed to relevant money laundering risks.
Sec. 4 GwBG-E also makes use of the option under Art. 6(1) AMLR to exempt certain entities which carry out financial activities occasionally or on a very limited scale from the AMLR requirements. These exemptions are to be reviewed as part of the national risk assessment.
Money Laundering Reporting Officer
Under Sec. 7 GwG, obliged entities are currently required to appoint an MLRO and a deputy. This concept is now discontinued: according to the Explanatory Memorandum, the appointment of a deputy is not provided for in the AMLR and will therefore no longer be required. However, Sec. 6(3) sent. 2 GwBG-E still allows the supervisory authority to require an obliged entity to dismiss a deputy MLRO.
Sec. 6(3) GwBG-E also retains the obligation to notify the appointment of the MLRO in advance; the Explanatory Memorandum argues that the AMLR only requires notification of a dismissal and assumes a regulatory gap.
Neither the AMLR nor the GwBG-E requires the MLRO or the deputy MLRO acting in the role of the MLRO to perform the function “in” Germany, which is a key change to the current regime under Sec. 7(5) GwG. This change may be particularly beneficial for EEA branches operating in Germany.
Automated account access (Sec. 24c KWG)
Credit institutions must currently store the number of each account, securities account and safe deposit box with the dates of opening and closing; the name, address and date of birth of the holder and any authorized person; and the name and, where collected, the address of a beneficial owner for the purposes of automated account access pursuant to Sec. 24c KWG.
Sec. 24c KWG-E expands the data set to the full identification data required under Art. 22(1) AMLR and extends it to virtual IBANs and crypto-asset accounts. Virtual IBANs have so far only been partly covered by a Bafin general administrative order (Allgemeinverfügung). The obligations apply correspondingly to crypto custodians (Sec. 45a KMAG-E) and to unlicensed safe deposit box providers (Sec. 6(5) GwBG-E).
All supervisory authorities in the financial and non-financial sector and AMLA will also be entitled to access the data, and Bafin’s own access will no longer require particular urgency as under the current rules.
Under Sec. 24d KWG-E, the national systems will further be connected to the EU-wide BARIS system, through which FIUs, AMLA and designated authorities of other member states can query a limited data set. Sec. 24e KWG-E introduces standardized technical formats for transmitting transaction data to law enforcement authorities.
Supervision
A Central Coordination Office for AML Supervision (Zentrale Koordinierungsstelle Geldwäscheaufsicht—ZKGw) will be set up at Bafin (Sec. 81 GwBG-E). It organizes a cross-sector coordination mechanism and sector-specific coordination mechanisms for sectors with multiple supervisory authorities, supporting the more than 150 different authorities that supervise the non-financial sector in Germany, e.g., in harmonizing interpretation guidance and in dealings with AMLA.
The ZKGw does not supervise obliged entities and has no powers to issue instructions to supervisory authorities; for banks and financial institutions, its establishment therefore does not change the supervisory relationship.
Sec. 80 GwBG-E also makes use of the option pursuant to Art. 41 AMLD6 to require payment, e-money and crypto-asset service providers operating establishments other than a subsidiary or a branch or operating on the basis of the freedom to provide services in Germany (and therefore in principle not qualifying as obliged entities) to appoint a central contact point vis-à-vis Bafin. The central contact point is responsible for ensuring compliance with AML law on behalf of the obliged entity.
Brief overview of selected further key changes for the financial sector
- Cash payments: Germany currently has no general cash payment limit; only cash payments for real estate transactions have been prohibited since April 1, 2023, while cash payments of EUR 10,000 or more trigger due diligence obligations for traders in goods. From July 10, 2027, the EU cash payment limit of EUR 10,000 for commercial transactions applies. The BMF does not intend to make use of the option for a lower national threshold. The national real estate cash ban is retained.
- FIU monitoring orders: A new power allows the FIU to order an obliged entity to monitor, for a period it specifies, transactions or activities carried out through one or more bank, payment or crypto-asset accounts or other business relationships that pose a significant money laundering or terrorist financing risk, and to report on the results (Sec. 52 GwBG-E). In addition, the duty to file suspicious transaction reports now follows from the AMLR and is focused on offences particularly relevant to money-laundering, with additional national reporting duties discontinued.
- Prohibition of transactions: The period for which the FIU may prohibit a transaction is reduced from one month (Sec. 40(4) GwG) to ten working days, or five working days for the use of an account or business relationship (Sec. 51 GwBG-E). This makes full use of the limits allowed under Art. 24 AMLD6.
- Sanctions: The maximum fines for infringements of AML law are increased in part, but the alternative turnover-based cap of 10% of total annual turnover remains. New are periodic penalty payments of up to 3% of average daily net turnover (Sec. 104 GwBG-E), as required under EU law.
- Transparency register: In accordance with EU requirements, the transparency register is to be granted greater powers of scrutiny and, in addition to verifying the accuracy of incoming and existing data, it shall also check whether the registered legal entities or their beneficial owners are subject to EU financial sanctions.
- Real estate information: By July 10, 2029, a central access point for real estate information will be set up at federal level (Sec. 43 GwBG-E, implementing Art. 18 AMLD6), giving competent authorities, in particular law enforcement authorities, immediate digital access to data on properties, owners, encumbrances and purchase prices that is currently only available on a decentralized basis.
Outlook
Stakeholders may comment on the Draft Bill until November 19, 2026. The federal government is scheduled to adopt the Draft Bill on December 19, 2026, which would then start the formal legislative process.
The Draft Bill is intended to enter into force on July 10, 2027, together with the application of the AMLR. Changes in the course of the parliamentary procedure should be closely monitored.
Institutions should use the remaining time to accelerate their implementation projects, in particular for such requirements that necessitate changes in the operational and IT processes, such as the extended account retrieval data set.
