AML in Germany: GwG, BaFin guidance and audit priorities

Short answer: Germany's AML requirements are set by the Money Laundering Act (Geldwäschegesetz, GwG). For firms supervised by BaFin, the regulator's interpretation and application guidance (AuA, general part, July 2025 version) shows how those duties are applied in practice. In 2026 BaFin plans at least 75 special audits, including customer risk classification and transaction monitoring. From 10 July 2027 the EU AML Regulation (AMLR) also applies directly.

This article is for money laundering reporting officers (MLROs), heads of compliance and management boards at banks, payment institutions, crypto-asset service providers and other financial firms in Germany. It explains what BaFin's guidance expects, where the supervisor is auditing in 2026, which deadlines apply and how much capacity implementation takes.

What are the GwG and BaFin's AML guidance about?

The GwG sets out the duties obliged entities must meet to prevent money laundering and terrorist financing; BaFin's interpretation and application guidance explains how the supervisor reads those duties. The guidance is not legislation, but it is the yardstick auditors use to assess a firm's AML framework. The general part is dated July 2025 (BaFin AuA on the GwG, general part, in German).

Three building blocks shape day-to-day practice:

• Risk management and internal safeguards: the firm analyses its own risks, derives controls from them and documents both.
• Money laundering reporting officer: appointed at management level, reporting directly to senior management and backed by a deputy. The role must be performed in Germany, and the officer enjoys special protection against dismissal (Section 7(1), (5) and (7) GwG).
• Customer due diligence: identifying customers, establishing beneficial owners and monitoring business relationships. Enhanced due diligence under Section 15 GwG applies in high-risk situations.

For the EU timeline of the AMLR and the new EU authority AMLA, see AMLR and AMLA: what compliance teams face from 2027.

Who is affected?

All GwG-obliged entities under BaFin supervision are affected, mainly credit institutions, financial services and investment firms, payment institutions and their agents, and crypto-asset service providers. BaFin's Circular 07/2026 (GW) on high-risk countries is addressed to exactly this group. Obliged entities outside the financial sector are supervised by other authorities and are not covered here.

Within a firm, AML prevention involves several functions at once:

• Management board: owns the AML framework. If a firm outsources the MLRO function, it must notify the supervisor in advance and remains responsible (Section 6(7) GwG; AuA para. 3.10).
• MLRO and deputy: run the risk analysis, controls, suspicious cases and contact with the supervisor.
• First line of defence: relationship management and onboarding supply the data on which risk classification and monitoring depend.
• IT and data management: operate monitoring systems, scenarios and thresholds.

Deadlines and status: GwG, BaFin and AMLR

The key dates run from BaFin's 2026 audit cycle to the AMLR's application date in July 2027. The table reflects the position on 10 November 2026.

Until 10 July 2027 the GwG, the AuA and BaFin circulars remain the governing framework. Our regulatory calendar lists all dates for Germany, Switzerland and the EU.

What firms need to do now

Firms should align their AML framework with BaFin's 2026 audit priorities while planning the move to the AMLR. This sequence works well:

1. Update the risk analysis: reassess customer, product, country and channel risks and treat terrorist financing separately. BaFin notes that amount-based controls easily miss small payments from legitimate sources.
2. Review customer risk classification: check criteria, data quality and review cycles against your risk analysis and record any backlog of updates. Our guide to KYC remediation planning covers staffing and process.
3. Calibrate transaction monitoring: justify scenarios and thresholds, document alert handling and clear backlogs (see clearing a transaction monitoring alert backlog).
4. Cover high-risk countries and sanctions evasion: implement Circular 07/2026 (GW). BaFin sees a markedly higher risk of evasion since Iran sanctions were reinstated in September 2025, for example through intermediaries or price manipulation.
5. Secure the MLRO's position: check resources, deputy arrangements and the reporting line to senior management; if outsourced, document the notification and internal oversight.
6. Start an AMLR gap analysis: record differences between current GwG practice and the AMLR, such as appointing a management body member as compliance manager (Art. 11 AMLR), and set an implementation plan to July 2027.

Which roles and how much capacity you need

Audit preparation, remediation and the AMLR transition tie up extra capacity for several months, which line teams rarely have spare. Roles differ by task:

Example (assumption): A firm must refresh 4,000 high-risk customer files at 1.5 hours per file, which is 6,000 hours. At 1,600 productive hours per full-time role, that is just under four full-time roles for a year, before quality assurance and project management.

How interim support helps

Interim professionals bridge the gap between an audit date and a permanent hire, while the firm keeps control. Alpinum Solutions provides AML and KYC specialists, compliance officers and complete project teams through staff leasing (Arbeitnehmerüberlassung, German temporary agency work) and freelancing, part-time or full-time from 20 to 100 %. Under staff leasing the client directs the work; freelancers work on their own responsibility within the agreed mandate.

• Remediation teams: KYC analysts and team leads for file backlogs and audit findings.
• Cover and reinforcement: experienced compliance officers for vacancies, parental leave or peak workloads in AML.
• Formal functions: interim professionals can also take on formal functions such as the MLRO role, although regulatory requirements may restrict the model. Statutory independence and responsibilities remain intact. Our article interim MLRO or AML project team? explains the options.

Alpinum is not a law firm and does not provide legal advice; whether an arrangement counts as outsourcing and how to notify it is for the firm to decide and document case by case.

Frequently asked questions about Germany's AML requirements and BaFin

Is BaFin's interpretation and application guidance on the GwG binding?

The guidance is not legislation but BaFin's administrative practice. It shows how the supervisor understands the duties under the GwG and what it measures firms against during audits. A firm that takes a different approach should be able to justify and document it. The general part is currently dated July 2025, and separate sector-specific parts exist for individual industries.

What will BaFin focus on in AML audits in 2026?

BaFin has announced at least 75 special audits for 2026. For banks the focus is customer risk classification and the travel rule for crypto-asset service providers; for non-banks it is the monitoring of business relationships and transactions. Across sectors BaFin also looks at counter-terrorist financing measures, business with high-risk countries and agents of EU payment institutions.

Can a firm outsource the MLRO function in Germany?

Yes, the GwG allows outsourcing (Section 6(7) GwG). It must be notified to the supervisor in advance, and responsibility stays with the obliged entity. The MLRO must sit at management level, report directly to senior management and work in Germany (Section 7 GwG). Whether a specific set-up counts as outsourcing is for the firm to assess case by case.

What changes with the AMLR from July 2027?

From 10 July 2027 the EU AML Regulation applies directly in all member states. Many detailed rules, for example on due diligence and beneficial ownership, will then sit in the regulation rather than in national law. One change is that a member of the management body must be appointed as compliance manager (Art. 11 AMLR). Firms should start their gap analysis in 2026.

What do firms need to do for high-risk countries?

Under BaFin Circular 07/2026 (GW) of 13 July 2026, transactions linked to Iran, North Korea and other countries on the EU list require at least enhanced due diligence under Section 15(5) GwG. Countries named only in the FATF's increased-monitoring list trigger no direct duties, but firms must still take the country risk into account appropriately.

Next step

If audit preparation, KYC backlogs or the AMLR transition need more capacity than your team has, talk to us about scope and profiles. Alpinum Solutions is the leading provider of interim legal & compliance in Germany; your company directs the assignment. Selected profiles are usually available within 48 hours; the start date is agreed jointly by the company and Alpinum.

• AML, KYC and financial crime compliance: remediation and taskforces
• Interim legal and compliance support in Germany
• AMLR and AMLA: what compliance teams face from 2027
• Regulatory radar: all articles on regulatory change
• Discuss your requirements

Last updated: 10 November 2026.