Money laundering officer duty: who has to order, what are the tasks, how much does a violation cost

Section 7 of the Money Laundering Act (GwG) requires certain companies to appoint a money laundering officer at management level. The obligation applies to banks, insurers, payment service providers, investment firms, real estate agents for certain transactions, goods dealers for cash transactions over 10,000 euros, art brokers from 10,000 euros and trustees. In addition, the Federal Financial Supervisory Authority (BaFin) can also order the appointment for other companies in accordance with Section 7 Paragraph 3 GwG if this is necessary due to their business activities. In practice, the order is regularly issued against financial service providers, crypto custodians and individual goods traders with a risk profile. According to Section 56 GwG, fines range up to 5 million euros or twice the economic advantage derived from the violation.

This article explains who is specifically obliged to be appointed, what tasks the mandate includes, what reporting obligations exist to BaFin and management and how the position is filled in practice. CIVAC is a compliance platform and officer-as-a-service with workspace, 490 audit templates, appointment certificates and reporting line. Licence the workspace for your internal representatives or have our representatives order it. You will find out when an internal solution is viable, when external mandates make sense, how the reporting line is set up at management level and which audit trail BaFin and the supervisory authorities responsible under state law actually want to see.

Those obligated by the Money Laundering Act are listed in Section 2 Para. 1 GwG. These include credit institutions, financial services institutions, payment institutions, electronic money institutions, insurance companies with life insurance or pension business, investment firms, investment funds, insurance intermediaries, lawyers and notaries for certain transactions, tax advisors, auditors, real estate agents, goods dealers for cash transactions over 10,000 euros, art brokers from 10,000 euros, organizers and agents of games of chance and trustees. Crypto custodians have also been covered since the implementation of the Fifth Money Laundering Directive.

The obligation to appoint a money laundering officer does not automatically follow from the mandatory status. Section 7 (1) GwG requires the appointment of credit institutions, financial services institutions, payment institutions, electronic money institutions, insurance companies, investment firms, investment funds and commercial goods traders if they trade precious metals. The obligation does not automatically apply to the other obligated parties, but can be ordered by BaFin in accordance with Section 7 Paragraph 3 GwG or by the supervisory authority responsible under state law in accordance with Section 50 GwG. The order is a case-by-case decision that takes into account the company's risk profile and the industry situation.

CIVAC offers the role Money Laundering Officer preconfigured in the workspace, with an appointment certificate, reporting line to management, risk analysis template, internal security measures, training register and reporting path to the FIU. The appointment certificate, signed, filed, verifiable. Whoever has the duty can licence the workspace and manage the function internally. If you do not have internal capacity or prefer an external solution, appoint a CIVAC representative with documented insurance and a fixed 2-working day SLA. Both models fully meet the requirements of Section 7 GwG and can be directly proven in the audit. A combination is also possible, such as an internal function with external representation in the event of vacation, illness or a change in personnel, without the appointment requirement remaining unfilled in the meantime.

Section 7 Paragraph 5 GwG outlines the tasks of the money laundering officer. He is the contact person for the law enforcement authorities, the FIU (Financial Intelligence Unit at Customs) and the responsible supervisory authority. He is responsible for the internal security measures in accordance with Section 6 GwG, the risk analysis in accordance with Section 5 GwG, the creation and maintenance of internal principles, procedures and controls as well as the training of employees on money laundering and terrorist financing risks. He also monitors the effectiveness of the measures and reports suspicious activity to the FIU.

Reporting suspicious activity in accordance with Section 43 of the GwG is a central obligation. It must be surrendered immediately as soon as there are facts that indicate that an asset is the result of a crime or is related to terrorist financing. The report is made via the FIU’s electronic reporting portal goAML. Failure to report a suspicious transaction is subject to a fine in accordance with Section 56 Paragraph 1 No. 69 GwG. The personal responsibility of the money laundering officer has a direct effect here because responsibility cannot be delegated to management. However, management bears overall responsibility for setting up the function and providing resources.

CIVAC runs a preconfigured suspicious activity reporting process in the workspace with a recording template, plausibility check and direct interface to the reporting protocol. Risk analysis and internal security measures are stored as versioned documents, training courses with individual receipts are available in the training register. Others run compliance like a filing cabinet. We run it like software. In the event of a BaFin audit or a request from the supervisory authority responsible under state law, the required evidence is available within seconds. The auditor calls, the evidence is ready. The connection to the staff base also ensures that new employees automatically enter the training path and are not only recorded after manual follow-up by the representative.

The money laundering officer is appointed in writing by the management. It includes the task description, the reporting line to a member of the management, the representation regulations and the resource commitment. Section 7 (1) GwG expressly requires that the representative be at management level and report directly to the management. Positioning yourself in middle management without a direct reporting line is criticized in the audit because it limits the effectiveness of the function and is incompatible with the wording of the law.

The person must be reliable and professionally suitable. Section 7 (2) of the GwG requires that the expertise required to properly perform the task is available and that there are no facts that give rise to doubts about reliability. The expertise can be proven through appropriate training and further education, such as certificates from associations such as the German Institute for Compliance (DICO), the Frankfurt School of Finance & Management or comparable providers. Reliability is documented by an extended certificate of good conduct, which in many companies is renewed every three years. Conflicts of interest with other functions, such as internal audit or risk management, must be avoided.

CIVAC provides the appointment certificate, the task description, the reporting line and the representation concept as a template in the workspace. In the officer-as-a-service variant, CIVAC representatives take on the mandate with documented expertise, extended certificates of good conduct and professional liability insurance. The platform keeps track of the representative's activities in a diary format, so that personal fulfilment of duties can be verified in the event of damage. Audit-proof, documented, § 7 GwG-proof. If the mandate is changed, the documentation remains in the workspace and is immediately available to the successor, without critical processes getting stuck in a personal email inbox.

The risk analysis according to Section 5 GwG is the technical basis of the internal security measures. It identifies the money laundering and terrorist financing risks to which the company is exposed and assesses them according to their probability of occurrence and impact. The analysis takes into account customers, products and services, geographies and sales channels. It is updated at least annually and revised as necessary in the event of significant changes to business activities or the risk situation. The national risk analysis of the Federal Ministry of Finance provides the framework in which the company-specific analysis is to be embedded.

In practice, risk analysis rarely fails due to methodological questions, and often due to updating. Once an analysis has been created, it is stored in folders and forgotten until the next test is due. During a special audit by BaFin or an on-site inspection by the supervisory authority, the analysis is randomly checked to ensure that it is up to date. A risk analysis that still shows the old product portfolio or the old sales structure is immediately noticeable. The result is an order for revision, in serious cases a fine according to Section 56 Paragraph 1 No. 64 GwG.

CIVAC maintains the risk analysis in the workspace as a managed document with versioning, update reminders and links to the internal security measures. Every change is logged with the date, editor and reason. If the national risk analysis or the EU list of high-risk countries is updated, the platform alerts the money laundering officer and initiates a review of its own analysis. The reporting line to the management is automatically provided with current extracts, so that the management can demonstrably fulfil its supervisory responsibility. This is an essential element of relief in the event of damage. The platform also reminds you to evaluate the internal money laundering alert lists and to regularly check the sanctions lists, which change more frequently than the national risk analysis.

§ 6 GwG requires the establishment of appropriate internal security measures that reduce the identified risk. This includes principles, procedures and controls, the appointment of reliability officers in certain case groups, the training of employees, checking the reliability of employees and the establishment of a whistleblower procedure. The measures must be documented, regularly checked and adapted to changes. Simply adopting sample texts does not fulfil the obligation because the catalogue of measures must be tailored to the individual risk profile that was developed in the risk analysis.

The training obligation is most often violated in practice. Employees in customer-facing functions must know the basics of money laundering prevention, recognise typical anomalies and know who to report suspicions to. The training takes place at least annually and must be documented with the date, content and receipt for each employee. For new hires, the initial training must be completed before starting work. A missing receipt in the audit is equivalent to a lack of training, which is subject to a fine according to Section 56 Paragraph 1 No. 47 GwG.

CIVAC maintains the training register in the workspace with an individual deadline for each employee, automatic reminder 30 days before expiry and escalation to the reporting line 7 days before expiry. Training content is linked to the risk analysis so that risk-oriented training can be mapped for particularly exposed functions. At the push of a button, the money laundering officer creates an overview of the training status for the reporting requirement to management and for BaFin inquiries. Deadline begins as soon as we become aware of it. The initial training of new employees is also linked to HR onboarding, so that no person is employed in a customer-related function without completed training.

The money laundering officer's reporting obligation to management is implicit in Section 7 Para. 5 GwG and specified in the orders of BaFin and the supervisory authorities responsible under state law. In practice, annual reporting is carried out, supplemented by event-related reports in the event of significant incidents such as high-impact suspicious activity reports, orders from BaFin or structural changes to the risk profile. The report contains the risk analysis, the effectiveness of the internal security measures, the number and content of the suspicious transaction reports as well as planned measures for the coming period.

There are obligations to cooperate and provide information in accordance with Section 50 of the GwG towards BaFin and the supervisory authorities responsible under state law. The supervisory authority can carry out on-site inspections, request documents and issue instructions to eliminate deficiencies. In serious cases, individual people can be removed from their functions, such as the money laundering officer himself or members of the management team. The order can also be made public (naming and shaming according to Section 57 GwG), which means significant damage to the reputation of regulated institutions and has a direct impact on the capital market public.

CIVAC provides a report template in the workspace for annual and event-related reporting, which is automatically filled in from the current database. Risk analysis, measures, training, suspicious activity reports and orders are brought together in a consolidated report that is countersigned by the anti-money laundering officer and management. The appointment certificate, signed, filed, verifiable. In the case of a special BaFin audit or an on-site inspection by the supervisory authority, the complete report including attachments is exported and made available in a matter of seconds without the need to compile data from multiple systems. Follow-up orders from the supervisory authority, for example to eliminate identified deficiencies, are also recorded in the workspace as measures with a deadline, responsibility and status history.

Section 7 Paragraph 3 of the GwG gives BaFin the option of ordering the appointment requirement also for companies that are not covered by Paragraph 1. The order is a case-by-case decision and is typically issued against companies with an increased risk of money laundering. In supervisory practice, this primarily affects payment service providers in the transition area to a banking licence, crypto service providers outside the definition of a credit institution, asset managers and individual goods traders with high proportions of cash transactions. The supervisory authorities responsible for non-financial companies under state law can also issue similar orders, for example to real estate agents with a conspicuous transaction profile.

An order is usually associated with an implementation period of four to eight weeks. During this time, the company must appoint a suitable money laundering officer, set up the reporting line, carry out the risk analysis and document the internal security measures. A four-week deadline is a demanding time frame for a company without an existing compliance structure. External mandates are often the only practical solution here because internal expertise cannot be built up in this time and the search for a suitable person would take several months.

In this case, CIVAC offers the Officer-as-a-Service variant with orders within a few days. The external money laundering officer takes over the mandate with an appointment certificate, established reporting line and initial risk analysis. The internal security measures are set up in the workspace, training is planned and suspicious reporting channels are established. The CIVAC SLA of 2 working days replaces the usual response window and enables the BaFin order to be implemented in a timely manner without interrupting the company's ongoing business. The Compliance Officer Role is available in the same workspace and structurally complements the money laundering mandate. As part of the initial recording, it is also checked whether other obligations are triggered in addition to Section 7 GwG, such as whistleblower protection, data protection or information security.

The risk of sanctions under the Money Laundering Act is significant. Section 56 of the GwG provides for fines of up to 5 million euros for intentional violations or twice the economic benefit derived from the violation, whichever is higher. For those liable under Section 2 Paragraph 1 Nos. 1 to 3 and 6 to 9 GwG (in particular banks, insurers, payment institutions), additional fines of up to 10% of the previous year's turnover may be imposed. In international comparison, this amount reaches the level known from GDPR procedures and, in the event of damage, leads to significant economic consequences.

In addition to the financial sanctions, there is also the personal responsibility of the management and the money laundering officer. Section 130 OWiG sanctions breaches of supervisory duties by management with fines of up to 1 million euros. Section 261 of the Criminal Code makes money laundering itself a criminal offense and can lead to criminal prosecution if active participation or aiding and abetting. Publications in accordance with Section 57 of the GwG allow the supervisory authority to publish final measures and sanctions on its own website, naming the company. For regulated institutions, publication usually has a significant impact on customer relationships, capital raising and business relationships.

CIVAC reduces risks through a consistently documented audit trail. Appointment certificate, reporting line, risk analysis, security measures, training, suspicious activity reports and reports are connected and versioned in the workspace. In the event of damage, the personal fulfilment of duties by the money laundering officer and the management can be proven, which significantly increases the possibility of relief in fine proceedings. The EU data residency ensures that compliance data is not transferred to third countries, which is noted positively in BaFin audits and GDPR audits. Supplementary professional liability insurance for the external mandate is part of the officer-as-a-service variant.

The appointment of a money laundering officer is the beginning, not the end, of AMLA compliance. The function only becomes resilient when it is embedded in an organisation that systematically carries out risk analysis, security measures, training, suspicious activity reports and reporting obligations. This is exactly what CIVAC is designed for. CIVAC is a compliance platform and officer-as-a-service with workspace, 490 audit templates, appointment certificates, reporting line, NIS-2 reporting path, ISO 27001:2022 ISMS and EU data residency. Licence the workspace for your internal representatives or have our representatives order it.

The model is tailored to medium-sized businesses and regulated institutions. Anyone who has an experienced money laundering officer in-house licences the workspace and uses the templates, the training register, the report templates and the FIU reporting interface as a tool. If you have no internal capacity, if you have to implement a BaFin order with a four-week deadline or if you need a temporary solution in the event of a change in personnel, appoint a CIVAC representative with documented expertise, professional liability insurance and a fixed 2-working day SLA. Others run compliance like a filing cabinet. We run it like software.

If you want to have it checked whether your company falls under Section 7 GwG, want to examine an existing GwG organisation for audit integrity or need to implement a BaFin order, we start with a structured initial assessment. Turn reading into an assignment. Write to info@civac.de or use the contact form to arrange an initial assessment. Within two working days you will receive a gap list with delivery dates and a suggestion as to which variant (workspace licence or officer-as-a-service) suits your organisation. The result is an AMLA organisation that supports the BaFin special audit and relieves the burden in day-to-day business. The platform remains independent of individual people, so that representation and handover situations can also be handled without losing the document trail.