Anti-Money Laundering Officer in Germany: Finance and Real Estate Compliance Without Gaps

Under § 7 of the German Money Laundering Act (GwG), credit institutions, financial services providers, and real estate agents handling transactions of EUR 10,000 or more in cash, or any sale or purchase of real estate, must appoint an anti-money laundering officer at management level. The Federal Financial Supervisory Authority (BaFin) and the Financial Intelligence Unit (FIU) enforce the regime, and the 2024 EU AML Package reinforces personal liability for the officer.

This article explains the legal frame, the practical duties in finance and real estate, the typical staffing gap, and how CIVAC, as a Compliance-Plattform und Officer-as-a-Service, equips your internal officer or supplies an external one. You will see what an audit-ready AML function looks like, what the FIU expects in a suspicious transaction report, and where most German firms still leave evidence on the table.

Section 7 of the Geldwaeschegesetz (GwG) defines who must appoint an anti-money laundering officer. The list includes credit institutions, financial services institutions under § 1 KWG, payment and e-money institutions, capital management companies, insurance intermediaries with life and accident products, and, since the 2017 reform, real estate agents and notaries handling property transactions.

The officer must sit at management level, must be reachable by BaFin and the FIU, and must have a documented deputy. The appointment is formalised in a Bestellurkunde that names the scope, the reporting line to the management board, and the resources granted. Bestellurkunde, unterschrieben, abgelegt, belegbar.

Real estate firms became obligated entities for any sale or purchase mediation, not only cash deals. The 2020 amendment to § 2 GwG closed the gap that had previously exempted many brokerages.

BaFin's interpretation note (Auslegungs- und Anwendungshinweise, last update 2024) sets the operational expectations: written risk analysis under § 5 GwG, group-wide policies under § 9 GwG, and ongoing training under § 6 GwG. Personal liability under § 56 GwG can reach EUR 5 million or 10 percent of annual turnover for legal entities.

For sector-specific guidance on the role itself, see our role page on the Geldwaeschebeauftragter, which covers appointment, deputy, and reporting line in detail.

For banks and financial services institutions, the AML officer sits inside the wider compliance architecture defined by MaRisk AT 4.4.2 and the BaFin circular MaRisk 2023. The officer must coordinate with the compliance function under MaRisk and with the IT security function under BAIT, but the AML mandate itself is non-delegable to a non-management role.

BaFin expects three artifacts on demand: the institution-specific risk analysis under § 5 GwG, the customer due diligence policy under § 10 GwG, and the suspicious transaction reporting workflow toward the FIU. The risk analysis must be updated at least annually and after material change events such as new products or new countries.

Customer due diligence in the German regime is more granular than the FATF baseline. Politically exposed persons, beneficial owners under § 3 GwG, and high-risk third countries each trigger enhanced measures. The Transparenzregister query is now mandatory before onboarding under § 12 GwG.

Payment institutions and e-money institutions under the ZAG must additionally screen against EU sanctions lists in real time. Failures here trigger both AML and sanctions-regime fines, often layered.

The audit trail is the heart of the function. The CIVAC workspace stores the risk analysis, the policy versions, the SAR drafts, and the training records in a single repository with EU data residency. The Pruefer ruft an, der Nachweis liegt bereit.

Real estate transactions in Germany trigger AML duties at multiple points. The Immobilienmakler must conduct customer due diligence on both buyer and seller before signing the brokerage agreement, must identify the beneficial owner under § 3 GwG, and must report any cash component of EUR 10,000 or more.

The 2023 Sanktionsdurchsetzungsgesetz II tightened the regime further. Cash payments for real estate are now effectively prohibited above the threshold, and notaries must verify the source of funds before notarisation under § 43 GwG.

The reporting duty toward the FIU under § 43 GwG is independent of any threshold. Suspicion alone triggers the report, and the report must be filed via the goAML portal before the transaction is executed where feasible. Frist laeuft ab Kenntnis.

Brokerages with more than ten employees or a specific risk profile must appoint a Geldwaeschebeauftragter under § 7 GwG. Smaller firms may be exempt from the formal appointment but remain fully obligated under §§ 4 to 6 GwG for risk management, training, and internal controls.

The most common evidence gap is the beneficial owner check. Many brokerages document the Transparenzregister query but not the plausibility check on the result. CIVAC templates close that gap with a two-step record.

The AML officer is personally liable under § 56 GwG and, in severe cases, criminally liable under § 261 StGB for negligent participation in money laundering. The reporting line must lead directly to the management board, not through a middle layer, and must be documented in writing.

The officer needs unrestricted access to client files, transaction data, and IT systems. § 7 GwG explicitly requires that the officer cannot be obstructed by line managers or by sales pressure. The dismissal protection in § 7 Abs. 7 GwG mirrors the protection granted to the data protection officer under § 6 BDSG.

BaFin's expectation is that the management board receives at minimum a quarterly AML report and an annual full report. The annual report covers the risk analysis update, the SAR volume and outcomes, the training completion, and any material findings from internal or external audit.

The Bestellurkunde is the foundation. It names the officer, the deputy, the scope, the resources, and the reporting line. Without a valid Bestellurkunde, BaFin treats the function as not appointed, which is itself a fineable offence under § 56 Abs. 1 Nr. 4 GwG.

CIVAC issues the Bestellurkunde from the workspace with audit-grade metadata, including signature timestamp, role scope, and resource allocation. Audit-fest, dokumentiert, § 7-fest.

The Financial Intelligence Unit at the Generalzolldirektion in Cologne operates the goAML reporting portal. Every obligated entity must register with the FIU and file suspicious transaction reports (SAR) through goAML. There is no de minimis exception; one indicator is enough to require a report.

The report must contain the customer identification, the transaction details, the suspicion narrative, and any supporting documents. The FIU has 72 hours to issue a transaction stop under § 46 GwG. Most reports are released within that window, but the officer must not execute the transaction before clearance unless execution is unavoidable.

Common indicators include unusual cash patterns, mismatch between client profile and transaction volume, third-party payments, structuring just below thresholds, and reluctance to provide beneficial owner information. The FIU publishes annual typology reports that the officer must integrate into the risk analysis.

Quality matters more than volume. A SAR with poor narrative gets deprioritised. The FIU's 2024 annual report flagged that real estate SARs in particular often lack context on the source of funds and the beneficial owner structure.

The CIVAC workspace ships with a goAML-aligned SAR template, a four-eyes review step, and a sealed archive that survives BaFin inspection ten years later.

The decision between an internal and an external AML officer is rarely a pure cost calculation. It is a question of independence, of bandwidth, and of personal liability exposure. Many mid-sized firms reach the appointment threshold without having a candidate who meets BaFin's expertise expectation.

Internal officers know the business, the products, and the clients. They also share the cultural pressure of the firm, which can compromise independence in edge cases. External officers bring sector breadth and a credible independence signal toward BaFin, but they need a deep onboarding to understand the firm.

CIVAC offers both models. Lizenzieren Sie den Workspace fuer Ihre internen Beauftragten, oder lassen Sie unsere Beauftragten bestellen. The workspace gives the internal officer the templates, the risk analysis engine, the SAR queue, and the audit trail. The Officer-as-a-Service variant adds a qualified person on the appointment letter.

BaFin permits external appointment under § 7 Abs. 1 GwG for institutions where internal appointment is disproportionate. Smaller financial services institutions, fintechs in the build phase, and real estate firms below the management threshold are typical candidates.

The hybrid model, where the internal officer holds the appointment and CIVAC supplies the operational backbone, is the most common arrangement among our finance clients. It preserves internal accountability while removing the staffing risk.

The EU AML Package, adopted in 2024, introduces the Anti-Money Laundering Authority (AMLA) in Frankfurt and replaces large parts of the German GwG with directly applicable EU regulation by 2027. The German AML officer must already prepare for the harmonised regime.

The single rulebook tightens customer due diligence, lowers the cash payment cap to EUR 10,000 EU-wide, and centralises supervision of selected obliged entities under AMLA. Real estate, crypto-asset service providers, and high-value goods traders fall under the new scope.

Sanctions screening, while legally distinct from AML, is operationally inseparable. The EU sanctions regime against Russia and Belarus, the OFAC SDN list, and the UN consolidated list must be screened in real time at onboarding and on every transaction. False positives are the operational pain point; a sound rule engine reduces noise by 60 to 80 percent.

The CIVAC workspace integrates sanctions screening through a vetted provider with EU data residency. Hits are routed into the four-eyes queue alongside SAR drafts, which preserves a single audit trail across both regimes.

For broader context on the regulatory landscape facing German firms, see our briefing on NIS-2 Umsetzung Deutschland 2026 and how it interlocks with financial sector supervision.

BaFin audits combine on-site inspections (Sonderpruefungen under § 44 KWG) and off-site reviews of annual reports. The AML officer is the central contact. Preparation means having ten artifacts available within 24 hours of request, not within ten days of negotiation.

The ten artifacts are: the Bestellurkunde, the risk analysis under § 5 GwG, the customer due diligence policy under § 10, the SAR log, the FIU correspondence, the training records under § 6, the internal audit reports, the management board reports, the sanctions screening logs, and the IT security evidence under BAIT.

The CIVAC workspace tags every document with the relevant paragraph and the audit window. A BaFin request for the 2024 risk analysis returns the file, the approval workflow, the management acknowledgement, and the change history in one click.

The 490 audit templates that ship with the workspace cover the GwG, the KWG, MaRisk, BAIT, and the EU AML Package transition. They are maintained against the current legal text and signed off by qualified counsel before release.

Andere fuehren Compliance wie einen Aktenschrank. Wir fuehren sie wie Software. The difference matters when BaFin walks in the door.

The AML officer role is not a one-time appointment. It is a continuous obligation that combines legal expertise, operational discipline, and rapid response capability. Most firms underestimate the operational load, especially around SAR quality and audit readiness.

CIVAC operates the function in two delivery models. The workspace license gives your internal officer the templates, the risk analysis engine, the SAR queue, the training module, and the audit-ready archive, all hosted in the EU. The Officer-as-a-Service model adds a qualified person on the Bestellurkunde, with a two-business-day SLA against the four to six weeks typical for traditional law firm appointments.

For finance and real estate clients, the typical onboarding combines a risk analysis workshop, a policy gap closure sprint, and a SAR backlog review. The first audit-ready milestone is reached within six weeks.

Our team includes qualified Geldwaeschebeauftragte with banking and real estate sector experience, supported by the platform's automation. The dual-model frame matters: lizenzieren Sie den Workspace fuer Ihre internen Beauftragten, oder lassen Sie unsere Beauftragten bestellen.

Aus dem Lesen einen Auftrag machen. Reach us at info@civac.de or via the contact form on civac.de to discuss the appointment and the workspace setup.