Germany-based businesses operating in regulated sectors face a fundamental shift in their anti-money laundering obligations as the EU's new framework moves from directive-based national rules towards directly applicable regulations and centralised supervision. The Anti-Money Laundering Authority (AMLA) became operational in July 2025, the Anti-Money Laundering Regulation (AMLR) and Sixth Anti-Money Laundering Directive (AMLD6) apply from 10 July 2027, and direct AMLA supervision of certain obliged entities begins in 2028. Organisations that have not begun gap analysis and remediation work now risk supervisory action, reputational damage, and potential personal liability for management.
Why the New EU AML Framework Changes the Risk Calculation for Germany
For years, AML compliance in Germany was shaped by successive directives transposed into national law and supervised domestically by BaFin. That architecture is being restructured at the European level. The AMLR is a directly applicable regulation, meaning that, unlike earlier directives, it will not pass through national transposition filters. Obliged entities in Germany will be bound by its requirements without waiting for German legislative implementation of every provision.
AMLD6 will require Germany to update its national supervisory and enforcement framework, including rules on sanctions and criminal liability, by the same 10 July 2027 date. In parallel, the regulatory technical standards (RTS) and implementing technical standards (ITS) issued under the AMLR framework must be finalised by 10 July 2026, giving obliged entities roughly one year from that point to embed new technical requirements before the regulation becomes binding.
The cumulative effect is that businesses cannot treat AMLA readiness as a future compliance cycle. The window for preparation is open now, and the sequencing of deadlines – RTS/ITS in 2026, AMLR and AMLD6 in 2027, direct supervision in 2028 – means that each stage builds on work that should already be underway.
Who Is Affected: Obliged Entities in Germany
The AMLR and AMLD6 framework preserves and extends the concept of obliged entities. In Germany, the affected population includes credit institutions, payment service providers, investment firms, crypto-asset service providers (CASPs), real estate agents and developers, lawyers, notaries, accountants, trust and company service providers, and certain high-value goods dealers. The precise scope of obligations varies by sector, but the core duties – customer due diligence (CDD), beneficial ownership verification, transaction monitoring, record-keeping, and suspicious transaction reporting – apply across all categories.
For businesses operating through a German GmbH or other corporate structure, the obligation to identify and verify ultimate beneficial owners and to register accurate information in the Handelsregister and the transparency register remains in force. AMLA and the new regulation sharpen the standards for what constitutes adequate verification and introduce more granular requirements for politically exposed persons, high-risk third countries, and cross-border correspondent relationships.
CASPs authorised under the MiCA framework have a particular interest in the convergence between MiCA licensing obligations and AML requirements. If your business sits at that intersection, our analysis of the MiCA licensing framework in Germany provides relevant context on how both regimes interact.
Key Obligations Under the AMLR: What Is Changing
The AMLR introduces harmonised, directly applicable rules in several areas where national divergence has historically created compliance complexity for cross-border groups. The principal changes relevant to German obliged entities include:
- Customer due diligence: standardised definitions and minimum requirements for simplified, standard, and enhanced CDD, with less discretion for national authorities to create parallel tracks.
- Beneficial ownership: reinforced rules on identifying and verifying the beneficial owners of legal entities, trusts, and similar arrangements, with stricter thresholds and reduced reliance on self-declaration.
- Transaction monitoring: expectations around automated and manual monitoring systems are being raised; the RTS expected by July 2026 will specify technical parameters.
- Group-wide programmes: entities that are part of international groups must implement group AML policies that meet AMLR standards, not only the standards of the highest-risk jurisdiction in the group.
- Third-country equivalence: the framework for relying on due diligence conducted in third countries is being revised, which affects German businesses with operations or clients in non-EU jurisdictions.
- AMLA direct supervision: from 2028, AMLA will directly supervise a defined population of the largest and highest-risk obliged entities across the EU, sitting alongside BaFin for those entities.
BaFin remains the primary national supervisor for German entities that do not fall within AMLA's direct supervision perimeter. However, AMLA will issue binding guidelines and conduct peer reviews, which will progressively harmonise supervisory expectations across member states including Germany.
Typical Compliance Gaps Identified in German Entities
In advising cross-border businesses on AML compliance, Ferraz & Whitmore regularly identifies a consistent set of structural gaps that create exposure under both current rules and the incoming framework:
- Outdated customer risk classification: risk scoring models that pre-date recent guidance from BaFin or that do not reflect updated FATF mutual evaluation findings.
- Beneficial ownership documentation: reliance on self-certification by corporate clients without independent verification steps, particularly for multi-layered structures involving non-EU holding companies.
- Fragmented transaction monitoring: monitoring systems that operate in silos across business lines, failing to generate a consolidated view of customer activity.
- Policy documentation lag: internal AML policies and procedures that reference superseded legislative references or that have not been updated following the entry into force of previous AMLD cycles.
- Training gaps: annual training that covers basic awareness but does not equip front-line staff to apply enhanced due diligence in practice.
- Cross-border inconsistency: group entities in Portugal, Cyprus, or other EU jurisdictions operating under materially different internal standards, creating group-level risk under the AMLR's group-wide programme requirements.
Each of these gaps carries direct supervisory risk. BaFin's enforcement activity in recent years has demonstrated a willingness to impose significant measures, including personal liability for management board members, where control failures are systemic rather than isolated. The Bundesgerichtshof has also addressed questions of corporate liability in financial crime contexts, reinforcing that German courts will not treat AML failures as purely regulatory rather than legal matters.
Timelines: A Practical Readiness Map
The following sequence reflects the key milestones that should anchor your internal planning:
- July 2025: AMLA became operational. Governance structures, appointment of leadership, and initial supervisory college work have begun. Obliged entities can begin engaging with AMLA's published consultation materials.
- 10 July 2026: Deadline for RTS and ITS under the AMLR. From this date, the technical standards that will define the operational details of AMLR compliance will be final. Gap analysis conducted before this date should be reviewed once the standards are published.
- 10 July 2027: AMLR and AMLD6 apply. All obliged entities in Germany must be fully compliant. This is the hard deadline for policy updates, system changes, training programmes, and governance restructuring.
- 2028: AMLA begins direct supervision of the largest cross-border obliged entities. Entities within this perimeter will face dual supervisory engagement from both AMLA and BaFin.
The gap between the RTS/ITS finalisation in July 2026 and the application date in July 2027 is, in practice, twelve months – a shorter window than it appears, given that internal approval processes, IT system changes, and staff retraining all require lead time. Organisations that begin the assessment phase in 2025 or early 2026 will be substantially better positioned than those that wait for the standards to be published before initiating any work.
If your organisation would like to discuss how these timelines apply to your specific structure and sector, please contact our team at info@ferrazwhitmore.com or visit our contacts page.
How Ferraz & Whitmore Supports AML Compliance in Germany
Our approach to AML compliance engagements in Germany is structured around four phases: assessment, design, implementation support, and ongoing advisory. We do not offer generic compliance templates; the work is anchored in the specific regulated activities, corporate structure, and cross-border footprint of the client.
In the assessment phase, we conduct a structured gap analysis against current German AML rules and the forthcoming AMLR requirements, reviewing existing policies, procedures, risk assessments, and training records. Where a business operates through a German GmbH alongside entities in other EU jurisdictions, we assess consistency of the group-wide AML programme, which will become a direct compliance obligation under the AMLR.
In the design phase, we assist in drafting or redrafting the AML risk assessment, CDD procedures, beneficial ownership identification processes, transaction monitoring frameworks, and internal reporting lines. We also advise on the governance arrangements required to demonstrate that the management body has effective oversight of AML risk – a requirement that both BaFin and AMLA will scrutinise.
Implementation support covers interaction with BaFin where prior engagement or notification is required, assistance with Handelsregister and transparency register filings, and coordination with technology and operations teams on monitoring system specifications. For clients with operations or counterparties outside Germany, we draw on our broader EU network, including experience in jurisdictions with distinct AML supervisory environments.
Further detail on our corporate law practice in Germany, including entity structuring and governance, is available on our Germany corporate law services page.
Cross-Border Dimension: Germany Within an EU AML Group
Many of the businesses we advise in Germany form part of broader EU or international groups. The AMLR's group-wide programme requirements will, from July 2027, require that the group AML policy meets AMLR standards at every level – not only in the jurisdiction with the most demanding national rules. This has practical implications for German subsidiaries of groups headquartered elsewhere, and for German parent companies with subsidiaries in lower-scrutiny jurisdictions.
For groups with a presence in multiple EU jurisdictions, the coordination between national supervisors and AMLA introduces complexity around which authority leads, which standards apply, and how audit trails are managed across borders. The AMLD6 also addresses minimum criminal law standards for money laundering offences across the EU, which will affect how German criminal exposure interacts with proceedings in other member states.
Our cross-jurisdictional experience includes work on AML frameworks in other EU member states. For context on how the same AMLR framework is being approached in another jurisdiction, our analysis of AML obligations for service providers in Cyprus illustrates the points of convergence and remaining national variation.
Self-Assessment Checklist: AML and AMLA Readiness
The following checklist is a starting point for internal discussion. It does not constitute legal advice and does not replace a formal gap analysis.
- Has your organisation confirmed whether it falls within the AMLR's definition of an obliged entity, and under which sectoral category?
- Is your customer risk classification methodology documented and last reviewed within the past twelve months?
- Do your CDD procedures include a defined process for identifying and verifying beneficial owners of corporate clients, including multi-layered structures?
- Are your beneficial ownership records consistent with current Handelsregister and transparency register filings?
- Does your transaction monitoring system generate a consolidated view of customer activity across all product lines?
- Has your AML risk assessment been updated to reflect the AMLR's forthcoming requirements, including any sector-specific guidance from BaFin?
- Is your training programme reviewed annually and does it address enhanced due diligence scenarios in practical terms?
- If you are part of a group operating in multiple EU jurisdictions, has your group-wide AML programme been assessed for AMLR consistency?
- Has your management board received documented briefing on AMLA timelines and the personal liability dimensions of AML control failures?
- Do you have a defined process for responding to BaFin supervisory enquiries and, where applicable, for engaging with AMLA from 2028?
Engaging Ferraz & Whitmore
Businesses and funds that identify gaps through this checklist, or that are navigating a specific BaFin enquiry, a change in corporate structure, or a cross-border transaction that raises AML questions, are welcome to contact our team. We advise in English, German, and Portuguese, and work with clients across the EU and in international markets.
To discuss your organisation's AML compliance position in Germany, reach us at info@ferrazwhitmore.com or through our contacts page. Initial discussions are conducted without commitment, and we will indicate clearly what work is required before any engagement begins.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.