Compliance Officer Services: Mandate, Workspace, Evidence

Section 130 OWiG holds management personally liable when the absence of supervisory measures enables a corporate offence, with fines up to 10 million euros under the GwG and 10 million euros or 2 percent of group turnover under the NIS-2 Implementation Act 2026. A compliance officer service translates that abstract duty of supervision into a named mandate, a documented control framework, and a reporting line that an auditor can verify in writing.

This article explains what compliance officer services cover in the German market in 2026, how the mandate is constructed, what evidence the function must produce, and where the cost ranges sit. It then sets out how CIVAC, a German compliance platform and officer-as-a-service, delivers the function: licence the workspace for your internal officers, or appoint our officers under formal mandate. Both routes end at the same place. The auditor calls, the evidence is ready.

Compliance officer services in Germany are a bundle of three things: a formal appointment letter under section 130 OWiG, a written control framework mapped to the laws that bind the company, and a reporting line that gives the officer unfiltered access to the management board. Anything less is advisory work, not an officer function.

The control framework typically covers anti-money-laundering duties under the GwG, anti-bribery controls aligned with section 299 StGB, sanctions screening against the EU consolidated list, and sector-specific overlays for financial services, healthcare, or critical infrastructure. Each control has an owner, a frequency, and a documented test.

Reporting is the part most often skipped. The officer must report at least annually to the management board in writing, escalate without filter, and document the escalation. Auditors look for the escalation log first, because it shows whether the function is real or decorative.

Whistleblowing intake under the HinSchG (German Whistleblower Protection Act) is increasingly bundled into the service, since the same officer often runs the internal reporting channel. CIVAC links the channel into the internal reporting office workspace so that intake, triage, and case file live in one audit trail.

The dual-model frame from CIVAC: licence the workspace for your internal officers, or appoint our officers under formal mandate. The deliverables, evidence, and escalation paths are identical in both routes.

Andere führen Compliance wie einen Aktenschrank. Wir führen sie wie Software.

German law does not impose a universal compliance officer obligation, but several statutes converge to make the function de facto mandatory for medium-sized and larger companies. The GwG requires a money laundering officer for obliged entities under section 7. The KWG demands a compliance function for credit institutions under section 25a. The WpHG applies the MaComp circular to investment firms.

Beyond regulated industries, section 130 OWiG creates a general supervisory duty whose breach is sanctioned with fines up to 10 million euros. Case law from the Federal Court of Justice (BGH, judgment of 17 July 2009, 5 StR 394/08) recognised that compliance officers have a guarantor position, which sharpens both the protection and the exposure of the role.

The NIS-2 Implementation Act, in force from October 2026, adds another layer for the roughly 29,500 entities classified as essential or important. They must designate a person responsible for cybersecurity who, in practice, sits next to or inside the compliance function. CIVAC publishes the NIS-2 implementation primer with the relevant deadlines.

Listed companies face additional pressure from section 91 paragraph 2 AktG, which requires the management board to install an early-warning system. Compliance is the operational layer of that system, and the officer is the named owner.

Group structures complicate the picture. A German subsidiary may inherit a group-level compliance officer, but the local appointment under section 130 OWiG still has to be documented locally. Auditors check the local file, not the group org chart.

Companies below 50 employees often work with an external compliance officer service to avoid the cost of a full-time hire while preserving the formal mandate and the documented control framework that the law expects.

A compliance officer service that holds up in audit produces a specific set of artefacts. The appointment letter, signed by management and the officer, dated, with scope and reporting line. The annual compliance plan, with risk assessment, controls, and milestones. The training register, with content, recipients, and completion dates. The case file, with anonymised entries for each material event.

The risk assessment is the foundation. It maps regulatory obligations to business processes, scores residual risk, and assigns controls. Without it, every other artefact is suspended in mid-air. CIVAC ships a risk assessment template covering the GwG, GwG-MeldV, AktG section 91, and sector overlays, pre-populated for German SMEs.

Controls without testing are decorative. Each control needs a documented test, a sample size, a tester, and a result. Quarterly testing is the market standard for material controls, annual testing for the rest. The 490 audit templates in the CIVAC workspace cover the most frequently tested controls and produce the evidence file automatically.

Escalation logs are the artefact that distinguishes a real function from a paper one. Every material concern raised by the officer, with date, recipient, response, and outcome, belongs in the log. The log is the first thing the BaFin or the public prosecutor will ask for if the function is challenged.

Bestellurkunde, unterschrieben, abgelegt, belegbar. The German phrase captures what the audit trail must achieve: appointment letter signed, filed, evidenced. CIVAC stores the appointment letter, the annual plan, the training register, and the escalation log in a single workspace with EU data residency.

The CIVAC SLA for the officer file is two working days from request to delivery, against the two to six weeks that classical advisory firms typically need.

Compliance officer services in Germany are priced in three common models: monthly retainer, per-diem advisory, and outcome-based mandates. The retainer dominates the SME segment, the per-diem applies to regulated industries with audit peaks, and outcome-based pricing is emerging for transformation projects.

Retainer ranges in 2026 for an external compliance officer mandate sit between 1,200 euros per month for companies under 50 employees with a simple risk profile and 6,500 euros per month for mid-market companies with regulated activities. The retainer typically includes the appointment, the annual plan, quarterly control testing, and one annual management board report.

Per-diem rates for senior compliance counsel range from 1,400 to 2,200 euros per day. Per-diem makes sense for audit preparation, internal investigations, or transactional support, but it does not satisfy section 130 OWiG on its own because the mandate must be continuous.

Outcome-based pricing ties part of the fee to a measurable result, such as a clean BaFin inspection or a successful ISO 27001:2022 certification. The model aligns incentives but requires a baseline measurement, which adds setup cost.

Hidden cost drivers are on-site days, multi-site coverage, and language requirements. A bilingual file in German and English, often required for international groups, adds roughly 15 to 20 percent to the retainer because every artefact has to be maintained in two versions.

CIVAC offers a published price list with three tiers and a fixed two-working-day SLA. The dual-model frame applies: licence the workspace for your internal officers, or appoint our officers under formal mandate. The price comparison is transparent for both routes.

Three operating models exist for the compliance officer function. Internal hire, external service, or hybrid. The choice depends on company size, risk exposure, and whether the function is treated as a cost centre or a control layer that protects the management board.

An internal compliance officer suits companies above roughly 250 employees with sustained regulatory exposure. The cost-loaded salary in Germany ranges from 95,000 to 150,000 euros for a mid-career profile, plus tooling, training, and substitute coverage during leave. Below that headcount, the internal model is usually under-utilised.

An external compliance officer service suits SMEs, growth companies, and group subsidiaries that need a formal mandate without a full-time hire. The external officer brings sector pattern recognition from multiple mandates, which often surfaces issues earlier than an internal hire who sees only one company.

The hybrid model places an internal coordinator inside the company and a senior external officer under formal mandate. The coordinator handles day-to-day intake and training, the external officer signs off the annual plan, reports to the management board, and absorbs the personal liability under section 130 OWiG.

CIVAC's dual-model frame matches all three operating models. Licence the workspace for an internal coordinator, appoint a CIVAC officer for the formal mandate, or combine both. The compliance officer role page lays out the deliverables for each variant.

The decision criterion is simple. Calculate the loaded internal cost, including substitute coverage during leave and certification refreshes, then compare to the external retainer. Below 250 employees, the external or hybrid model is usually cheaper and more resilient.

The mandate is the legal instrument that creates the compliance officer function. Without a signed appointment letter, the function does not exist in the sense of section 130 OWiG, regardless of how much advisory work is being done. The letter must name the officer, define the scope, document the reporting line, and bear two signatures.

Scope definition is the most negotiated clause. A broad scope (all compliance matters) is easier to defend in audit but harder to deliver. A narrow scope (e.g., GwG only) is easier to deliver but exposes gaps. The market standard for mid-market companies is a layered scope with a core mandate and named overlays for AML, sanctions, and sector rules.

The reporting line clause determines whether the function is real. The officer must report directly to the management board, with the right to escalate without filter and without prior approval. A reporting line that runs through the CFO or general counsel undermines the function and is regularly criticised by auditors.

Liability allocation between officer and company follows section 130 OWiG and BGH case law. The company carries the supervisory liability, the officer carries the guarantor position once accepted. Professional indemnity insurance for external compliance officers in Germany typically covers 3 to 10 million euros per claim.

Termination clauses require care. A short notice period (e.g., 30 days) can expose the company during audit windows. The market standard is a minimum 90-day notice with a handover protocol that includes the file, the annual plan, and an open-cases list.

CIVAC ships a Bestellurkunde template that is review-ready by external counsel and pre-mapped to section 130 OWiG, the GwG, the HinSchG, and the NIS-2 reporting duties.

A compliance officer function without a workspace is a stack of Word files in a shared drive that nobody can find when the auditor asks. The workspace is the operational layer that turns the mandate into evidence: a central file with the appointment letter, the annual plan, the risk assessment, the control library, the case log, the training register, and the management board reports.

The CIVAC workspace is built on ISO/IEC 27001:2022 controls (93 controls in the 2022 annex) and runs in an EU-resident environment. Access is role-based, every change is logged, and the file can be exported in a regulator-ready format within minutes. The two-working-day SLA covers the full file delivery, including signed appointment letter.

Templates cover the artefacts that auditors ask for most often. The 490 audit templates in the CIVAC workspace include the annual compliance plan, the risk assessment, the control testing worksheet, the management board report, the training register, the escalation log, the GwG suspicious activity workflow, and the HinSchG case file. Each template is field-tested in audit.

The reporting line is enforced in the workspace by routing. Reports flagged as management board correspondence move directly to the named recipients, bypass intermediary inboxes, and trigger an acknowledgement requirement. The acknowledgement is the audit evidence that the report was received.

Integration into existing tools matters. The CIVAC workspace exports to common DMS systems, links into the data protection officer file when GDPR matters cross over, and synchronises with the NIS-2 24-hour and 72-hour reporting paths required from October 2026.

Der Prüfer ruft an, der Nachweis liegt bereit.

CIVAC is a German compliance platform and officer-as-a-service. The platform side licences the workspace, the templates, and the controls to companies that run the function internally. The service side appoints CIVAC officers under formal mandate for companies that prefer to outsource the role. The dual-model frame is the core proposition.

Onboarding follows a fixed sequence. Day one, kickoff and scope clarification. Day two, signed appointment letter and access provisioning. Week one, completed risk assessment and annual plan. Week four, first control testing cycle. Quarter one, first management board report. The two-working-day SLA applies to standard requests after onboarding.

The officer roster covers compliance officers, data protection officers, information security officers, anti-money-laundering officers, ESG officers, and the 25 mandated roles in total. All 25 roles are live, and each role has a published role page with deliverables, escalation paths, and pricing tiers.

EU data residency is enforced at infrastructure level. No data leaves the EU, no subprocessor outside the EU has access to the workspace, and the ISO 27001:2022 certification scope explicitly covers the residency boundary. For regulated clients, this resolves the data transfer questions that often block US-based compliance vendors.

Pricing is published. The workspace licence runs in three tiers. The officer-as-a-service mandate is priced per role and company size, with a transparent comparison sheet against classical advisory firms. The mandate includes the appointment letter, the workspace access, the annual plan, the control testing, the training, the case log, and the management board reporting.

The CIVAC SLA, two working days, contrasts with the two to six weeks that classical advisory firms typically need to deliver the same file. The SLA is contractual, not aspirational.

The cheapest moment to install a compliance officer function is before the regulator calls or the prosecutor opens a file. The most expensive moment is during the inspection, when the officer must be appointed retroactively and the artefacts must be reconstructed under time pressure. The market spread between the two moments is regularly a factor of ten.

If the function is missing or thin, the next step is a 30-minute scoping call. Bring the company size, the regulated activities, the existing officer roles if any, the audit calendar, and the group structure. CIVAC returns a one-page scoping note with the recommended mandate, the deliverables, the SLA, and the price.

If the function exists but the evidence is scattered, the next step is a file review. CIVAC compares the existing artefacts against the 490 audit templates, lists the gaps, and proposes a remediation plan with a fixed timeline. The review takes two working days and is priced as a flat fee.

The dual-model frame remains the choice. Licence the workspace for your internal officers and run the function in-house, with the CIVAC templates and controls as the operational layer. Or appoint CIVAC officers under formal mandate and let CIVAC carry the role, the file, and the reporting line.

Both routes end at the same artefact: a Bestellurkunde, a workspace, a control library, an escalation log, and a management board report that the auditor can verify in writing. Bestellurkunde, unterschrieben, abgelegt, belegbar.

Aus dem Lesen einen Auftrag machen. Write to info@civac.de or use the contact form on civac.de. The scoping call is free, the scoping note is delivered within two working days.