Germany’s New AML Act: Getting Ready for 2027

Germany is about to rewrite its anti-money laundering rulebook from the ground up. On 10 July 2027, the EU Anti-Money Laundering Regulation (AMLR) becomes directly applicable across all member states, and Berlin plans to repeal its 2017 Money Laundering Act (Geldwäschegesetz, GwG) on the same day. Its successor, the Geldwäschebekämpfungsgesetz (GwBG), was published as a ministerial draft by the Federal Ministry of Finance on 28 October 2026. For banks, payment institutions, crypto-asset service providers, real estate professionals and many other businesses, the next eight months will decide whether the switch is orderly or chaotic.

A new rulebook, not an amendment

The most important change is structural. Until now, German AML obligations were set out almost entirely in national law and interpreted through guidance from the Federal Financial Supervisory Authority (BaFin). From July 2027, the core duties — risk assessment, customer due diligence, beneficial ownership checks, record keeping and suspicious activity reporting — will come directly from the AMLR (Regulation (EU) 2024/1624). The GwBG will mainly do three things: implement the Sixth Anti-Money Laundering Directive (AMLD6), use the options the AMLR leaves to member states, and organise the national supervisory architecture.

The legislative timetable is tight. The draft is currently in consultation with industry associations, with comments due by 19 November 2026. Cabinet approval is planned before the end of the year, after which the bill goes to the Bundestag and Bundesrat. Firms should therefore treat the draft as a strong signal of direction, not as final law, and keep monitoring changes during the parliamentary process.

Who is covered

Under the new regime, the list of obliged entities follows Article 3 AMLR. Germany adds a few national categories that are already covered today, such as institutions that only take deposits without being CRR credit institutions, and providers of qualified crypto custody or crypto securities registers. For these firms, the AMLR is intended to apply in full.

At the same time, the circle narrows in places. Most general traders in goods would no longer be obliged entities; the obligations would focus on dealers in precious metals and stones, high-value goods and cultural goods. This goes hand in hand with the EU-wide cash payment limit of EUR 10,000 under Article 80 AMLR. Germany goes further for real estate: the draft would prohibit paying for domestic property, or shares in property-holding companies, with cash, crypto-assets, gold, platinum or precious stones.

Governance moves to the top

The AMLR puts responsibility firmly at management level. Article 11 requires obliged entities to appoint a compliance manager from the management body, who is accountable for AML compliance, and a compliance officer who handles day-to-day policies, controls and suspicious activity reports. In German practice, the compliance officer role largely corresponds to today’s Geldwäschebeauftragter, or money laundering reporting officer (MLRO).

Two details in the German draft deserve attention. First, the current requirement that the MLRO should generally work in Germany would not be carried over. Second, the statutory obligation to appoint a deputy MLRO would disappear. That does not make continuity planning optional — supervisors will still expect the function to be available, competent and adequately resourced at all times — but it gives firms more freedom in how they design it.

This is why many institutions are reviewing whether to keep the function in-house, share it within a group, or combine internal staff with external specialists. Firms that consider outsourcing the MLRO function in Germany should note that the AMLR permits outsourcing of operational tasks under Article 18, but never transfers responsibility. Decisions such as approving the business-wide risk assessment, adopting internal policies and assigning customer risk profiles remain with the obliged entity itself.

Higher enforcement exposure

The draft also sharpens sanctions. Under the current GwG, many breaches only lead to fines if they were committed intentionally or with gross negligence. The GwBG draft extends liability to ordinary negligence for numerous offences. In other words, a process failure that would have escaped a fine in the past may now be sanctionable.

For credit and financial institutions, fines for serious, repeated or systematic breaches can reach EUR 10 million or, where turnover exceeds EUR 100 million, up to 10 per cent of total annual turnover; group turnover may be taken into account. Supervisors would also gain periodic penalty payments of up to 3 per cent of average daily turnover to enforce corrective measures. For management bodies, the message is clear: documented, working controls are the best protection.

New players in supervision

Germany’s AML supervision is famously fragmented, with roughly 250 state authorities and chambers overseeing around 200,000 non-financial obliged entities. The draft creates a Central Coordination Office for AML Supervision (ZKGw) at BaFin to align these supervisors, although it will not supervise firms directly.

On the European level, the new Anti-Money Laundering Authority in Frankfurt is drafting the technical standards that will fill in many AMLR details, from customer due diligence to the methodology for risk classification. Compliance teams should follow the consultations and publications of the EU Anti-Money Laundering Authority closely, because these standards will shape supervisory expectations in practice. From 2028, AMLA will also directly supervise a limited group of high-risk cross-border financial institutions.

A practical roadmap

With the application date approaching, a structured transition plan is essential. Firms can work through the following steps:

1. Gap analysis: compare existing policies, procedures and controls with the AMLR and the GwBG draft, and record which requirements are new, changed or removed.
2. Business-wide risk assessment: update methodology and risk factors to meet Article 10 AMLR and the expected AMLA standards.
3. Governance: formally designate the compliance manager and compliance officer, define reporting lines and document decisions by the management body.
4. Customer due diligence: review onboarding, beneficial ownership verification and ongoing monitoring, including the treatment of existing customers.
5. Outsourcing and group arrangements: check contracts, service levels and oversight against Article 18 AMLR.
6. Training and evidence: train staff on the new rules and keep audit-ready records showing that controls are actually performed.

Smaller institutions often lack the capacity to run this programme alongside daily business. Working with independent AML compliance specialists can help to structure the gap analysis and build the evidence supervisors will ask for, provided the internal ownership of every key decision remains clear.

Conclusion

The move from the GwG to the GwBG is more than a change of name. It shifts the legal basis of AML compliance to Brussels, raises expectations on management bodies and widens the scope for fines. The draft may still change before it reaches the statute book, but the AMLR itself is fixed and will apply from 10 July 2027. Firms that start their transition now will be able to absorb late changes calmly; those that wait for the final German text risk running out of time.