Money laundering officer: duty, appointment, tasks according to Section 7 GwG

According to Section 7 of the Money Laundering Act (GwG), the money laundering officer is the personal contact point of a person obliged to prevent money laundering and terrorist financing. The appointment is not just a formal exercise, but also transfers personal responsibility with direct reporting to management and BaFin. Fines of up to 5 million euros according to Section 56 GwG, and for legal entities up to twice the economic advantage, are considered an anchor value.

This guide shows who must appoint a money laundering officer, the twelve tasks assigned by Section 7 in conjunction with Section 6 GwG, what qualifications the position requires and how the appointment can be reliably proven in an audit by BaFin or the responsible state authority.

Section 7 paragraph 1 GwG regulates the obligation to appoint a money laundering officer and a deputy. The obligation is standard for credit institutions, financial services institutions, payment and electronic money institutions, insurers with life insurance and accident insurance with premium refunds, as well as for capital management companies.

For other obligated parties according to Section 2 of the GwG, such as goods dealers, real estate agents, art dealers, tax advisors and notaries, the responsible supervisory authority orders the appointment if the risk requires it. The benchmark is the risk analysis in accordance with Section 5 GwG and the activity, business model and size of the company.

For cash transactions of more than 10,000 euros (Section 4 Paragraph 5 GwG), goods dealers are subject to the obligation to identify themselves and can be obliged to do so by the supervisory authority. Art dealers with a transaction value of 10,000 euros or more, precious metal dealers with a cash threshold of 2,000 euros or more, real estate agents when arranging purchases, exchanges or rentals are regularly in focus.

Even if the appointment is voluntary, the function according to Section 7 GwG is fully effective, i.e. with special protection against dismissal according to Section 7 Paragraph 7 GwG and reporting line to management. These effects cannot be limited by internal regulations.

CIVAC is a compliance platform and officer-as-a-service. The Money Laundering Officer can be appointed internally or as an external representative. In both cases, the appointment certificate, the catalogue of duties and the reporting line are available as a template.

The appointment is made in writing and names a money laundering officer and a deputy. Both must be members of the management or senior employees within the meaning of Section 5 BetrVG or have a functional equivalent. An unsubstantiated delegation to subordinate positions is not permitted.

The appointment certificate includes seven components: function and representative, legal basis (§ 7 GwG), list of tasks, powers and information rights, reporting line directly to the management, time budget and proof of qualifications. The agent's declaration of acceptance is mandatory.

According to Section 7 Paragraph 6 of the GwG, the appointment and any changes must be reported to the responsible supervisory authority immediately. For banks and insurers this is BaFin, for other obligated parties it is the respective state authority (usually the district government or the regional council). The advertisement contains name, function, qualifications and accessibility.

The money laundering officer enjoys special protection against dismissal in accordance with Section 7 Paragraph 7 of the GwG. Termination of the employment relationship is only permitted for good cause in accordance with Section 626 of the German Civil Code (BGB) and protection against dismissal continues to apply even one year after termination of the position.

The appointment certificate in accordance with Section 7 of the GwG, including a notification template for the responsible supervisory authority, is available in the CIVAC Workspace. The appointment certificate, signed, filed, verifiable. SLA: 2 working days instead of 2 to 6 weeks classic.

The catalogue of tasks results from Section 7 Paragraph 5 GwG and refers to the internal security measures according to Section 6 GwG. Task 1 is the risk analysis in accordance with Section 5 GwG, which assesses the company with regard to money laundering and terrorist financing risks and updates it at least annually.

Task 2 is the development and maintenance of internal principles, procedures and controls in accordance with Section 6 Paragraph 2 GwG. Task 3 is the establishment of strategies that identify money laundering-relevant processes, including threshold values ​​and escalation paths.

Task 4 is the training of employees in accordance with Section 6 Paragraph 2 Number 6 GwG, at least annually. Task 5 is the background check of employees when they are hired and during their ongoing employment relationship. Task 6 is the processing of internal suspicious transaction reports.

Task 7 is the submission of suspicious transaction reports to the Central Office for Financial Transaction Investigations (FIU) via the goAML reporting portal in accordance with Section 43 of the GwG. Task 8 is to respond to requests for information from the FIU and the law enforcement authorities.

Tasks 9 to 12: Storage of money laundering files in accordance with Section 8 of the GwG (at least five years), obligation to report to management at least annually, participation in audits by the supervisory authority, cooperation with the Compliance Officer and the Data Protection Officer.

The risk analysis is the technical basis for all further security measures. Section 5 of the GwG requires a written risk analysis that records all risks arising from the type and scope of the business activity. It must be updated at least annually and presented at any time upon request of the supervisory authority.

Methodologically, the risk analysis is divided into four dimensions: customers (geographical origin, legal form, PEP status), products and services (anonymous products, proximity to cash, cross-border transactions), sales channels (presence, distance selling, intermediaries) and geography (high-risk countries according to the appendix of the EU list).

For each dimension, an inherent risk and a residual risk is assessed after the application of internal security measures. Scales with three to five levels are common. Hochrisikofälle nach § 15 GwG erfordern verstärkte Sorgfaltspflichten, vereinfachte Sorgfaltspflichten nach § 14 GwG sind bei geringem Risiko zulässig.

Die Ergebnisse der Risikoanalyse fließen in die Geschäftsanweisungen, die Schwellenwerte für Transaktionsmonitoring, die Schulungsplanung und die KYC-Prozesse ein. A risk analysis that has no operational consequences is considered incomplete in the audit.

The risk analysis is stored as a template in the CIVAC Workspace, including categories, scales, examples and connection to the security measures. Audit-proof, documented, § 5 GwG-proof. The annual update is controlled by resubmission without the money laundering officer having to actively search for the date.

The general due diligence obligations according to Section 10 GwG include identification of the contractual partner (Section 11 GwG), clarification of the beneficial owner (Section 3 GwG), obtaining information about the purpose and nature of the business relationship and continuous monitoring of the business relationship.

Identification is carried out using official identification documents for natural persons and using the commercial register or comparable registers for legal entities. Since 2017, the transparency register according to Section 18 GwG has been the central source for beneficial owners; It has been a full register since 2022.

Politically exposed persons (PEP) according to Section 1 Paragraph 12 GwG, their family members and close people are subject to increased due diligence obligations according to Section 15 GwG. The business relationship may only be established with the consent of the management and the source of funds must be verified.

High-risk states according to the Annex to Delegated Regulation (EU) 2016/1675 also trigger increased due diligence requirements. This includes additional information about the business partner, the source of funds and the business relationship as well as closer ongoing monitoring.

KYC templates, PEP list connection and transparency register queries are stored procedurally in the CIVAC Workspace. Licence the workspace for your internal representatives, or have our representatives order it. Both models lead to the same auditable file and the same EU data residence.

§ 43 GwG requires the reporting of facts that suggest that an asset comes from a predicate crime for money laundering, is related to terrorist financing or that the contractual partner does not fulfil its legal obligation to disclose. Suspicion is sufficient; proof is not required.

The report is made electronically via the FIU's goAML reporting portal. Deadline: immediately, in practice within one working day of becoming known. The deadline begins as soon as we become aware of it. Eine verspätete Meldung kann nach § 56 Absatz 1 Nummer 69 GwG mit Bußgeld geahndet werden.

Nach § 46 GwG dürfen mit der Verdachtsmeldung verbundene Transaktionen für drei Werktage nicht durchgeführt werden, sofern nicht die FIU oder die Staatsanwaltschaft die Durchführung gestattet. This stay of execution protects the investigations.

The ban on passing on information according to Section 47 of the GwG (so-called tipping-off ban) prohibits the obligated party from informing the contractual partner or third parties about the report submitted. Violations are punishable according to Section 53 of the GwG. This obligation must be explicitly addressed in the internal procedure.

In the CIVAC Workspace, the suspicious activity reporting path leads from the employee via the money laundering officer to the FIU as a guided workflow with a time stamp, four-eye approval and automatic blocking of the affected transaction until clarification. The auditor calls, the evidence is ready.

§ 7 paragraph 4 GwG requires the professional suitability and personal reliability of the money laundering officer. This is made more concrete by the BaFin Interpretation and Application Notes (AuA) as well as by sector-specific requirements, such as MaRisk for banks.

Professional suitability includes knowledge of money laundering law, sector law (banking, insurance or commercial law), internal business processes and risk analysis. A relevant degree or a comparable qualification as well as several years of professional experience in compliance, law or internal auditing are common.

Personal reliability is proven by a certificate of good conduct, a self-declaration and, if necessary, by information from the central trade register. Previous convictions for property, tax or money laundering offenses regularly rule out suitability.

Position in the company: direct reporting line to management, freedom from professional instructions, sufficient time budget and right to information in all areas. A purely "sideline job" in addition to the main area of ​​responsibility is often too limited; BaFin only accepts this if the risk is low and the company is small.

The external money laundering officer is permitted according to Section 7 Paragraph 2 of the GwG and is a pragmatic solution, especially for smaller obliged entities. Licence the workspace for your internal representatives, or have our representatives order it. In the Officer-as-a-Service model, CIVAC provides the appointed money laundering officer with their own liability insurance.

The supervision of compliance with the AMLA obligations lies with BaFin for banks, insurers and financial service providers, as well as with the state authorities for other obliged entities. The supervisory authority regularly checks on site, in writing and as part of special audits, for example based on information from the FIU.

The audit report from the auditor or internal auditor typically includes: appointment of the money laundering officer, completeness and timeliness of the risk analysis, implementation of internal security measures, random checks of KYC files, suspicious activity reporting and proof of training.

Frequent complaints: risk analysis without operational consequences, KYC files without documentation of plausibility checks, lack of ongoing monitoring of the business relationship, late reports of suspicious activity, incomplete proof of training and lack of updating of the transparency register comparison.

Fines according to Section 56 GwG range up to 5 million euros or twice the economic benefit. In the event of systematic violations, the supervisory authority can take additional personal measures, such as dismissing the money laundering officer or prohibiting business activities in accordance with Section 51 of the GwG.

CIVAC maps the entire audit grid in the workspace. 490 ready-to-use audit templates, including risk analysis, KYC file, SAR log, training matrix, cover the typical audit points. Audit-proof, documented, § 56 GwG-proof. The FAQ section answers the most frequently asked detailed questions.

If you cannot say in two sentences today who your money laundering officer is, when the last risk analysis was updated and how many suspicious activity reports were submitted last year, AMLA compliance is not audit-proof. Start with a status check in four steps: appointment certificate, risk analysis, KYC sample, reporting log.

CIVAC delivers the appointment certificate, risk analysis template, KYC scheme and reporting log in 2 working days. In the Workspace model, you licence the templates and run the function internally. In the Officer-as-a-Service model, an appointed money laundering officer with his own liability insurance takes over the function.

Both models use the same pool of 490 audit templates, the same EU data residency and the same reporting channel. You decide based on capacity, not platform change. It is possible to switch between models in the current year without data migration.

Others run compliance like a filing cabinet. We run it like software. Instead of distributed Excel lists, PDF files and email threads, you receive a versioned file status with a time stamp, four-eye approval and audit export that meets BaFin requirements.

Turn reading into a mandate. Write to info@civac.de or use the contact form on civac.de. We check your obligated status, suggest the appropriate model and provide the appointment certificate and risk analysis within 2 working days.