External Money Laundering Compliance Officer: Annual Costs and What the Appointment Includes

§ 7 para. 1 of the Money Laundering Act (GwG/AMLA) requires certain companies to appoint a money laundering compliance officer and a deputy. This person bears responsibility for compliance with GwG obligations — in particular the identification of suspicious indicators, reporting to the Financial Intelligence Unit (FIU) under § 43 GwG, and the internal risk analysis and risk management under §§ 4 to 9 GwG.

In practice, the question of what an external money laundering compliance officer costs is often difficult to answer, because market offerings vary considerably and cover different scopes of service. This article clarifies what an external money laundering compliance officer must deliver under the legal requirements, what cost ranges are realistic, and what to look for when making an appointment.

§ 7 para. 1 GwG requires the appointment of a money laundering compliance officer for obligated parties under § 2 GwG, provided the Federal Financial Supervisory Authority (BaFin), the competent state authority, or a statutory order so directs. In practice, the following companies are regularly required to make an appointment:

• Credit institutions and financial services institutions (§ 2 para. 1 no. 1 GwG)
• Insurance undertakings, to the extent they offer life insurance or certain other insurance products (§ 2 para. 1 no. 7 GwG)
• Capital management companies (§ 2 para. 1 no. 6 GwG)
• Estate agents above a certain turnover threshold (§ 2 para. 1 no. 14 GwG)
• Goods traders for cash payments of EUR 10,000 or more (§ 2 para. 1 no. 16 GwG)
• Lawyers, notaries, tax advisers, and auditors in certain areas of activity (§ 2 para. 1 nos. 10 to 12 GwG)

For companies holding a licence under the Banking Act (KWG), the Payment Services Supervision Act (ZAG), or the Capital Investment Code (KAGB), the appointment obligation is generally enshrined in statute. The precise determination of whether a company is subject to the appointment obligation must be made by reference to the supervisory framework. The CIVAC section on the money laundering compliance officer provides structured guidance in this regard.

The scope of services of an external money laundering compliance officer is defined by the statutory obligations under §§ 4 to 9 and §§ 43 to 45 GwG. A full annual mandate covers the following core services in practice:

• Internal risk analysis (§ 5 GwG): Annual update of the risk analysis for the company, assessment of the customer base, product range, geographic activity, and distribution channels.
• Risk management and internal safeguarding measures (§§ 6 to 9 GwG): Development and updating of internal policies, procedures, and controls to prevent money laundering and terrorist financing.
• Customer due diligence (§§ 10 to 17 GwG): Oversight of customer due diligence processes, in particular for politically exposed persons (PEP) and high-risk customers.
• FIU reports (§§ 43 to 45 GwG): Submission of suspicious activity reports to the Financial Intelligence Unit, documentation of reports, and record-keeping obligations under § 8 GwG.
• Employee training (§ 6 para. 2 no. 6 GwG): Annual risk-based training of employees with proof of attendance.
• Point of contact for supervisory authorities: Primary contact for enquiries from BaFin or the competent state authorities.

Offerings that cover only risk analysis and policy development, without including FIU reporting and training, do not fully cover the legally required scope of services.

The costs of an external money laundering compliance officer vary considerably depending on the type of company, risk class, and scope of services. The following benchmark ranges have become established in practice:

These guideline figures are based on the 2025 and 2026 market environment and include a full mandate with annual risk analysis, policy update, FIU reporting service, and employee training. Offerings significantly below these ranges should be critically reviewed with respect to scope of services and the qualifications of the named officer.

When selecting an external money laundering compliance officer, the following criteria are decisive in addition to price:

• Personal qualifications: § 7 para. 4 GwG requires the officer to be reliable, to possess the necessary expertise, and to be able to devote sufficient time to the role. For companies supervised by BaFin, the suitability of the named person must be accepted by the supervisory authority.
• Sector knowledge: The risk analysis must be tailored to the company's specific business model. An officer with exclusively banking experience cannot adequately assess the risk profile of an estate agent.
• Availability: The external officer must be reachable for employees wishing to report suspicious indicators. A pure mailbox solution without defined response times does not meet this requirement.
• Experience with FIU reports: FIU suspicious activity reports are complex and must be submitted completely and on time. Lack of experience in this area significantly increases liability risk.
• Documentation quality: All activities of the officer must be retained for five years pursuant to § 8 GwG. The officer must ensure audit-proof documentation.

Before engagement, companies should agree on a written service description with defined deliverables, response times, and reporting obligations.

The appointment of an external money laundering compliance officer is subject to strict formal requirements that are frequently underestimated in practice.

• Named appointment of a natural person: § 7 para. 2 GwG requires the appointment of a natural person. A legal entity cannot serve as a money laundering compliance officer; the named officer must be a specifically identified employee of the appointed firm.
• Written appointment: The appointment deed must be in writing and must clearly set out the officer's powers — in particular the right of access to all relevant information and documents (§ 7 para. 5 GwG).
• Notification to the supervisory authority: Where required by the competent supervisory authority (BaFin or state authority), the external appointment must be notified in advance or promptly following appointment.
• Deputy: § 7 para. 1 sentence 1 GwG also requires the appointment of a deputy. The deputy must meet the same qualification requirements as the principal officer.

Appointment deed, signed, filed, verifiable. The same document principle that applies to all other formal officer appointments applies equally to the money laundering compliance officer: without written evidence, the appointment cannot be substantiated in a BaFin audit.

The decision between an internal and an external money laundering compliance officer depends on three factors: company size, complexity of the business model, and available internal expertise.

An internal officer offers advantages in terms of availability, company knowledge, and continuity. They are directly accessible to employees and have first-hand knowledge of the company's specific risk profiles. The drawback: building qualifications, ongoing continuing education, and covering for holidays or illness require significant internal investment.

An external officer provides immediately deployable qualifications and established processes. They are particularly suitable for smaller and medium-sized obligated entities where a full-time equivalent internally is not economically viable; companies that require an officer at short notice; and companies with infrequent or complex suspicious cases requiring specialised FIU expertise.

The CIVAC model also allows a hybrid approach: the workspace is licensed for the internal compliance coordinator, while the external officer from the CIVAC network takes on FIU reporting, risk analysis methodology, and training. This reduces the costs of a full mandate whilst maintaining quality assurance.

The suspicious activity reporting obligation under § 43 GwG is the most sensitive responsibility of the money laundering compliance officer. As soon as an employee or the officer themselves identifies facts indicating that a business transaction may be connected to money laundering or terrorist financing, a suspicious activity report must be submitted to the FIU without delay. The deadline runs from the point of knowledge.

Reports are submitted electronically via the FIU reporting portal (goAML). They must contain complete information on the persons involved, the transaction, the facts giving rise to suspicion, and measures already taken. An incomplete report or a failure to report can be sanctioned under § 56 GwG with a fine of up to EUR 100,000; in cases of intent and significant amounts, higher sanctions are possible.

During the processing of a suspicious activity report, a provisional transaction prohibition generally applies: the company may not execute the reported transaction for three working days unless the FIU grants clearance or does not object within that period. An external officer with FIU experience knows these procedures and can respond quickly when needed.

For companies with frequent reporting obligations — such as estate agents in premium-price regions or payment service providers with an international customer portfolio — the officer's experience with FIU reports should be a central selection criterion.

BaFin and the competent state GwG authorities regularly review compliance with anti-money laundering legislation through on-site inspections and document requests. The following points are typically in focus:

• Existence of a current, written risk analysis under § 5 GwG
• Documentation of customer due diligence and KYC (Know Your Customer) processes
• Evidence of annual employee training under § 6 para. 2 no. 6 GwG
• Completeness and currency of internal policies
• Evidence of the formal appointment, including the appointment deed and deputy
• Documentation of all FIU reports from the past five years

§ 56 GwG provides for fines that may range from EUR 100,000 to EUR 10 million depending on the nature and severity of the infringement. For credit institutions, BaFin may also take measures under § 49 GwG, including withdrawal of the business licence.

An external officer who maintains a complete documentation workspace for their clients significantly reduces audit risk. The auditor calls, the evidence is ready. This is not a marketing promise — it is an operational requirement.

If you are assessing whether your company requires a money laundering compliance officer, begin with the review under § 2 GwG: does the company fall within the category of obligated parties? Is there a directive from the competent supervisory authority? Does the obligation arise from a statutory order or from authorisation under the KWG, ZAG, or KAGB?

If the review reveals an appointment obligation, the following approach is recommended: first, define service requirements in writing; then assess proposals for completeness of service scope; verify the qualifications of the named officer; and finally issue an appointment deed with clearly defined powers.

CIVAC provides, as a compliance platform and Officer-as-a-Service, external money laundering compliance officers from its certified partner network. Licence the workspace for your internal officers or appoint our officers directly. Contract, named person, and deed are completed within two working days. Other solutions require two to six weeks for this process.

For an assessment of the scope of services and costs tailored to your company profile, write to info@civac.de. Turn reading into a mandate.