Money laundering officer duty: Which industry has to order?

According to Section 6 (1) of the GwG, obliged entities within the meaning of Section 2 of the GwG must appoint a money laundering officer at management level if the supervisory authority orders this or the law expressly provides for it. The list of obligated parties includes credit and financial institutions, insurance companies, insurance intermediaries, financial investment intermediaries, fee-based financial investment advisors, auditors, tax advisors, lawyers, notaries, real estate agents, organizers and brokers of games of chance, goods dealers above certain thresholds, art dealers, art brokers and trustees. For banks and insurance companies, the obligation to order is explicitly stipulated in Section 7 Para. 1 GwG, for the other obligated parties a differentiated obligation applies depending on the order of the responsible authority (BaFin, BAFA, state supervisory authority, IHK).

Anyone who does not order where they should be ordered risks fines according to Section 56 GwG in the amount of up to 5 million euros or 10 percent of the annual turnover, plus personal liability of the management § 130 OWiG. This article shows which industries are subject to the obligation, when an order is required depending on the situation, what tasks the representative has and how CIVAC's compliance platform and officer-as-a-service bundles the appointment certificate, the risk analysis according to Section 5 GwG and the reporting of suspicious cases to the FIU in the same workspace. The appointment certificate, signed, filed, verifiable.

Section 2 Paragraph 1 GwG lists 17 groups of obligated parties. These include, firstly, credit institutions according to Section 1 Paragraph 1 KWG including the branches of foreign institutions, secondly financial services institutions according to Section 1 Paragraph 1a KWG, thirdly payment institutions and electronic money institutions according to ZAG, fourthly life and accident insurance companies with capital formation as well as health insurers, fifthly insurance intermediaries according to Section 34d GewO for the insurance lines mentioned. Sixthly, capital management companies according to KAGB, seventhly, financial investment and fee-based financial investment brokers according to Sections 34f and 34h GewO. Eighthly, auditors, tax advisors, accountants, lawyers, patent attorneys and notaries for certain activities.

Ninthly, service providers for companies and trust assets, tenthly, real estate agents for purchase contracts and rental agreements with a monthly rent of 10,000 euros or more. Eleventhly, organizers and brokers of games of chance, twelfthly, goods dealers with a cash transaction value of 10,000 euros or more, thirteenth, art brokers, art dealers and art warehouse keepers with a cash transaction value of 10,000 euros or more. Fourteenth, crypto asset service providers in accordance with Section 1 Paragraph 11 KWG, fifteenth, organizers of sports betting, sixteenth, electronic financial institutions and seventeenth, trustees. The exact classification is not always obvious, which is why the external money laundering officer in the CIVAC Workspace uses an industry and activity matrix to check whether and to what extent the obligation applies. Others run compliance like a filing cabinet. We run it like software. Particularly in the case of mixed activities, for example when a tax advisor also performs fiduciary functions or a real estate agent also deals in art, expert classification is crucial. The matrix also takes into account multi-state constellations in which individual activities in different federal states are assigned to different supervisory authorities. This gives management a quick, clear picture of the extent to which the AMLA obligations apply and which steps need to be planned for the next twelve months.

§ 7 para. 1 GwG obliges those obliged under § 2 para. 1 Nos. 1 to 3 and Nos. 6 to 9 GwG to appoint a money laundering officer at management level and a representative. This particularly affects banks, financial institutions, insurance companies, capital management companies and crypto asset service providers. For the other obligated parties, the responsible supervisory authority can order the appointment if it considers it necessary given the risks in the business model. This order is made by BaFin, BAFA, state supervisory authority, bar association or tax advisors' association, depending on the industry.

For goods traders with a cash transaction above the threshold of 10,000 euros (precious metal trade from 2,000 euros), the order obligation often arises from the respective state supervisory authority, for example in North Rhine-Westphalia via the district government. The same applies to real estate agents with a monthly rent of 10,000 euros or a purchase price of 10,000 euros or more in cash transactions. The order is usually made on a case-by-case basis, but can also be made as part of a comprehensive industry audit. A list of indicators is stored in the CIVAC Workspace that shows the business volume and risk level for which an order is recommended, even if it has not yet been formally ordered. Licence the workspace for your internal representatives or have our representatives order it. Both provide the same proof: appointment certificate, signed, filed, verifiable. Experience has shown that a proactive order before a formal order is made means that in the event of a later audit, the overall picture of care is convincing and the arguments to the supervisory authority can be conducted in a much more relaxed manner. In case of doubt, a missing order acts as an indication of organisational negligence according to Section 130 OWiG. Particularly if the business volume is growing or new sales channels are being opened, it is worth ordering early so as not to be forced into action by an external complaint.

The money laundering officer is responsible for compliance with money laundering regulations in accordance with Section 7 Paragraph 5 of the GwG. His tasks include, firstly, the preparation and updating of the risk analysis in accordance with Section 5 GwG, secondly the development of internal security measures in accordance with Section 6 GwG, thirdly the training of employees in accordance with Section 6 Paragraph 2 No. 6 GwG, fourthly the monitoring of employee reliability in accordance with Section 6 Paragraph 5 GwG. Fifthly, the processing of suspicious activity reports and reporting to the FIU (Financial Intelligence Unit) in accordance with Section 43 of the GwG and sixthly, the annual reporting to the management. He is also the contact person for the supervisory authority and the FIU.

The deadline for a suspicious transaction report in accordance with Section 43 of the GwG is immediate. For cash transactions or asset transfers that indicate money laundering or terrorist financing, reporting must occur immediately, usually before the transaction is completed. Deadline begins as soon as we become aware of it. In the CIVAC Workspace there is a reporting path that documents the recording, evaluation and transmission to the FIU. The external money laundering officer checks the suspected cases and submits the report via the FIU's goAML portal. You can find out more about the role on the page for the CIVAC money laundering officer. The auditor calls, the evidence is ready. without having to use internal resources. This also means that the relationship with management is more professionally regulated because they receive the required reports and evaluations in a consolidated inventory and do not have to reconstruct them from email threads. Quarterly reports with key figures on suspected cases, risk assessments and training levels become routine and provide management with the basis for their own duty of care in accordance with Section 130 OWiG. For supervisory boards and advisory boards, these reports are an important part of the monitoring obligation and are actively required in modern governance structures.

§ 5 GwG obliges every obligated party to prepare a risk analysis. This must identify and evaluate the risks with regard to customers, products, sales channels and countries and link them to appropriate internal security measures. The risk analysis must be updated regularly, at least annually, and as necessary. Regulators require them first when beginning an audit. An incomplete or superficial risk analysis is the most common finding in BaFin audits and state supervisory audits.

A parameterized template for the risk analysis is available in the CIVAC Workspace, which the money laundering officer enriches with industry, customer typology, product portfolio, sales channels and country risks. The engine creates the first draft, the GwB supplements the assessment and the derived measures. Versioning and audit trail are built in. For occasions such as changes to the business model, new product lines or new countries, an update request automatically goes into the representative's task list. Audit-proof, documented, § 5-GwG-proof. In the event of an audit by BaFin or the state supervisory authority, the current version, including version history and source information, is made available in seconds without the internal team having to research under pressure. The risk analysis is also the basis for the internal security measures in accordance with Section 6 GwG, so that the measures documented in the workspace are derived directly from the analysis and remain continuously traceable. This avoids the frequent complaint that measures are formally available but do not clearly fit the risk analysis. The effectiveness check of the measures, which Section 6 GwG expressly requires, is also documented in the workspace, so that the supervisory authority can check not only the existence but also the actual effect of the security measures. This turns a static document into a living part of the internal control system.

According to Section 7 Para. 1 GwG, the money laundering officer must be at management level and have sufficient authority to carry out his tasks independently. He must report directly to the management and must not be bound by instructions in his function. A deputy is mandatory, which must also be appointed and documented in writing. The appointment document must contain the name, function, duties, authorities, reporting line and start date of the appointment. A dismissal may only take place for an important reason and must be reported to the supervisory authority immediately.

In medium-sized companies there is often no suitable internal manager who has specialist knowledge and reliability in accordance with Section 7 Paragraph 4 GwG. Then appointing an external money laundering officer in the Officer-as-a-Service model is the pragmatic way. CIVAC will provide a representative including an appointment certificate within two working days, including representation. The external representative works in the workspace and uses the 490 audit templates, the risk analysis mechanics and the FIU reporting path. You can find an overview of the 25 available representative roles on the CIVAC role overview. Licence the workspace for your internal representatives or have our representatives order it. In both models, the appointment certificate is versioned and verifiable in the same system. A change in the money laundering officer, for example due to a reallocation of tasks or staff fluctuation, is also clearly documented through versioning so that the supervisory authority can trace a complete order chain. The deadline expires as soon as we become aware of it, which is why special care is necessary, especially in the transition between two agents. This is why the deputy is so important: it ensures the functionality of money laundering prevention when the main representative is absent or cannot carry out his duties at short notice, and it is documented in the same workspace with its own appointment certificate. An escalation path has also been set up for particularly serious suspected cases, so that management is informed immediately in critical situations.

§ 56 GwG provides for fines of up to 5 million euros or 10 percent of the annual turnover, whichever is higher, for intentional, serious violations. For frivolous violations, the maximum limit is lower, but still significant. Specifically, the following are punished: missing orders, inadequate risk analysis, missing internal security measures, missing or late suspicious activity reports and missing or inadequate employee training. Supervisory authorities regularly publish the fines in quarterly reports, which leads to reputational damage that can be significantly more expensive than the fine itself.

In addition, there is the personal liability of management according to Section 130 OWiG if organisational obligations have been violated. Management can also be personally liable to shareholders or creditors if damage arises from a violation of the AMLA. In the event of damage, for example if the company was unknowingly used for money laundering or terrorist financing, there is a risk of further criminal and civil consequences. Turn reading into a mandate.: Anyone who has not appointed a money laundering officer today, even though they are classified as an obligated party, should clarify their status within a few weeks before a supervisory audit discovers the deficiency. A subsequent order usually does not reduce the fine. However, it can be viewed as cooperative behaviour in the fine procedure and can reduce the amount of the sanction in individual cases. On the other hand, anyone who waits until the authorities take action signals inaction and weakens their own defensive position. Insurers also take the level of money laundering prevention into account in their D&O and financial loss liability coverage, so that a clean list has a double effect: once towards the supervisory authority, and once towards the insurer. Anyone who acts in a timely manner can also achieve a more favorable credit rating from banks because the internal control system is considered to be more mature.

Banks and financial service providers: The obligation to order is mandatory according to Section 7 Para. 1 GwG. BaFin regularly checks the functionality of money laundering prevention and the quality of the risk analysis. Frequent complaints concern the customer due diligence obligations according to Section 10 GwG, the identification of beneficial owners according to Section 11 GwG and the monitoring of politically exposed persons according to Section 1 Paragraph 12 GwG. Insurance companies with capital-forming products are subject to the same strict requirements as banks.

Real estate agents: Since the 2025 AMLA draft, the threshold for cash transactions has been lowered to 10,000 euros. Brokerage activities above this threshold are relevant to the AMLA. Goods dealers: The 10,000 euro threshold for cash transactions generally applies, and for precious metal trading even from 2,000 euros. Those affected include car dealerships, yacht and boat dealers, jewelry and precious metal dealers. Cryptocurrency service providers: Since the Sanctions Enforcement Act II, this group has been expressly covered; MiCAR and new BaFin interpretations expand the requirements every year. In the CIVAC Workspace there is a separate template and a tailored risk analysis mechanism for each of these industries, so that the specifics are recorded and the representative can work professionally. The appointment certificate, signed, filed, verifiable. Gambling providers and sports betting organizers must also comply with the requirements of the federal states' gambling regulators, whose practices have become considerably more stringent in recent years and are continually being adapted. Lawyers, tax advisors and notaries are also subject to the AMLA obligations for certain activities and must reconcile special confidentiality requirements with the reporting obligation in accordance with Section 43 AMLA. The requirements of the respective professional chambers also apply to these professional groups, which are also stored in the workspace and support the representatives in distinguishing between activities that are protected by mandate protection and activities that are subject to reporting.

An external money laundering officer in the officer-as-a-service model costs between 450 and 2,500 euros per month, depending on the industry, risk assessment and volume. The package includes an appointment certificate, risk analysis, employee training, FIU reports, annual report and answers to inquiries from authorities. A pure law firm with hourly billing typically costs twice to four times as much. A workspace licence for an internal order costs 250 to 900 euros per month and contains the same templates, the same audit trail and the same FIU reporting path, but without the external representative.

The delivery time for the initial preparation (appointment certificate, risk analysis, training concept) is two working days in the CIVAC SLA. For traditional law firms, two to six weeks are usual, depending on workload and queries. Speed ​​is particularly relevant for medium-sized companies that, for example, have to respond to a supervisory order or a customer inquiry about compliance. Licence the workspace for your internal representatives or have our representatives order it. In both models you get the same documentation quality and audit trail. Audit-proof, documented, § 6-GwG-proof. An additional advantage is the connection to identification services (eID, VideoIdent) and to the FIU via goAML, which are integrated into the workspace in a standardised manner and do not require an additional integration project. An initial threshold analysis for cash transactions and an automated anomaly check for returning customers can also be implemented, so that operational controls and documented compliance go hand in hand and are not managed in separate systems. There is also the possibility of linking the AMLA obligations directly with other compliance areas, such as the data protection impact assessment for customer identification or the ISMS statement to secure the identification processes. This creates a continuous compliance stack, not a patchwork of individual documents from different providers.

CIVAC's compliance platform and officer-as-a-service brings together anti-money laundering obligations in a workspace that is operated with EU data residency and hardened against an ISO/IEC 27001:2022 certified ISMS with 93 controls. Appointment certificate, risk analysis according to Section 5 GwG, internal security measures according to Section 6 GwG, employee training according to Section 6 Paragraph 2 No. 6 GwG, suspicious activity reports via goAML to the FIU according to Section 43 GwG and the annual report to the management are versioned and filed in an audit-proof manner. 490 templates and 25 available officer roles ensure consistency across data protection, information security, supply chain and workplace safety.

You have two paths. First: You licence the workspace and manage the order with your internal money laundering officer and his representative. Second: You hand over the order to CIVAC and receive an external money laundering officer within two working days, including an appointment certificate, risk analysis and employee training. Hybrid models are also possible, such as a workspace licence with targeted temporary help from CIVAC representatives. Turn reading into a mandate.: Write to info@civac.de or use the contact form on civac.de. You will receive an initial assessment of your obliged entity status according to Section 2 GwG, a gap analysis compared to the current requirements and a suggestion as to which model will reduce the effort the fastest. The appointment certificate, signed, filed, verifiable. The auditor calls, the evidence is ready. because every order, every risk analysis, every FIU report and every training course is documented in the same workspace, thus ensuring the completeness required by Section 6 GwG. Licence the workspace for your internal representatives or have our representatives order it.