Financial Integrity Monitor
Sign in

Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.

Financial Integrity Monitor

Germany DE

Domains covered
8 of 8
Sources
187
Role actions
8
Horizon <90d
1
Jurisdiction profile
FATF status: Largely Compliant Tier: A Risk direction: Stable Enablement vs enforcement: Mixed

Germany operates a comprehensive AML/CFT framework (Geldwäschegesetz, Criminal Code, Banking Act) supervised by BaFin, the FIU (Zoll), and over 300 sector/Länder-level supervisors, with the EU's new AML Authority (AMLA) headquartered in Frankfurt.

Key deficiencies
  • Critical under-resourcing of the >300 DNFBP/financial supervisors relative to roughly 1 million supervised non-financial entities
  • No market entry checks for the trust and company service provider (TCSP) sector
  • Underutilized Transparency Register with very low suspicious-transaction reporting from real estate agents
  • High cash usage and limited proactive identification of unlicensed hawala/MVTS operators
  • Fragmented coordination across Germany's 16 Länder supervisory and law-enforcement authorities
Recent developments (18m)
  • Frankfurt prosecutors raided Deutsche Bank offices in Frankfurt and Berlin (28 Jan 2026) in a money-laundering probe linked to historic transactions with sanctioned oligarch Roman Abramovich
  • A second, previously unreported Deutsche Bank AML probe (stemming from a May 2025 search) was confirmed by prosecutors on 30 Jan 2026
  • Deutsche Bank self-reported potential sanctions breaches involving Russian clients to the Bundesbank (April 2026)
  • Germany's federal prosecutor ordered the arrest of five men over alleged €30 million sanctions-busting exports to Russia (2 Feb 2026)
  • German police broke up a fraud/money-laundering network involving staff at four major German payment providers, worth an estimated $350 million (5 Nov 2025)
  • AMLA became operational in Frankfurt with a Council-appointed chair (Jan 2025) as the EU AML Package build-out continues

Law made at European Economic Area level that applies in Germany is covered once, on the European Economic Area page. This page covers Germany’s own layer: implementation, national authorities, national options and local enforcement.

Brief

Lead signal

Lead Signal

Germanys supervisory track record this period is defined by routine, active enforcement rather than any structural shift in the rules it applies. Over 21 to 22 October 2026, BaFin took three distinct actions that, read together, describe a regulator exercising its existing powers across three different registers of financial-crime risk: withdrawal of a banking licence held by the German branch of an Iranian bank, monetary fines against an individual for breach of securities-notification duties, and a public warning against an entity offering banking services without authorisation. None of these actions changes the underlying legal framework; each applies it.

Read full brief

Lead Signal

Germanys supervisory track record this period is defined by routine, active enforcement rather than any structural shift in the rules it applies. Over 21 to 22 October 2026, BaFin took three distinct actions that, read together, describe a regulator exercising its existing powers across three different registers of financial-crime risk: withdrawal of a banking licence held by the German branch of an Iranian bank, monetary fines against an individual for breach of securities-notification duties, and a public warning against an entity offering banking services without authorisation. None of these actions changes the underlying legal framework; each applies it.

The most consequential of the three is the withdrawal of authorisation from Bank Saderat Iran's Hamburg branch, with an accompanying wind-down order. A licence withdrawal against the German branch of an Iranian financial institution sits adjacent to the sanctions architecture that governs dealings with Iranian counterparties, even though the action itself is framed as a licensing and prudential matter rather than a sanctions designation. The timing and target are consistent with established German and EU supervisory practice toward Iranian financial institutions, continuing a posture that has held steady rather than shifting this period.

Other Developments

Notification-duty fines under the Wertpapierhandelsgesetz. On 21 October 2026, BaFin imposed two fines of EUR 6,000 each, EUR 12,000 in total, against an unnamed natural person for breaching notification duties under German securities-trading law. This is a market-transparency enforcement action rather than a money-laundering matter in the narrow sense, but it sits within the same supervisory apparatus and reflects BaFin's continued willingness to impose monetary penalties for disclosure failures.

Public warning against unlicensed banking activity. Also on 21 October 2026, BaFin issued a consumer warning against an entity styling itself Mineral Resources Holdings and Commercial Investment Bureau, operating via the website mraib.com, for offering banking business without the required authorisation under German banking law. Warnings of this kind are a standing tool in BaFin's enforcement repertoire against unlicensed cross-border solicitation, and the absence of a formally identified operator is itself a familiar feature of this category of case.

Cross-Monitor Connections

The licence withdrawal against Bank Saderat Iran's Hamburg branch touches the sanctions-and-market-access architecture that other monitors track from different angles: a prudential regulator removing a licensed foothold for an Iranian-linked institution has effects on correspondent access and market exclusion that extend beyond the immediate supervisory decision. The unlicensed-activity warning, by contrast, is a pattern recurring across many jurisdictions regardless of sector, and its significance lies more in the routineness of the response than in any novel typology it reveals.

Outlook

None of this period's three actions signals a change in Germany's regulatory architecture; all three are enforcement against a framework that remains stable. The more informative question going forward is whether the Bank Saderat Iran wind-down generates further disclosures about the scope of its activity before closure, and whether BaFin's warning against the mraib.com operation leads to any identification of the entity behind it. Absent new instrument-level developments, the near-term picture for Germany in this area is one of continuity in supervisory posture rather than reform.

Earlier periodic briefs (6)
18 Oct 2026 · fim-2026-10-18

Lead Signal

Germanys financial-crime supervisor BaFin delivered the clearest signal of the cycle by refusing futurum bank AGs application for MiCAR crypto-asset service provider (CASP) authorisation, an application that had been pending since 27 June 2025. The refusal, disclosed 6 October 2026 through Bitcoin Group SEs mandatory ad-hoc notice rather than through a BaFin-published enforcement notice, ends the toleration under which futurum bank had continued operating Bitcoin.de style crypto-asset services while the application sat under review. Germany shortened its own national grandfathering window under the MiCA transition architecture to 31 December 2025, six months ahead of the EU-wide outer limit, and this refusal is the first concrete enforcement data point showing that cut-off carries real consequence for an established, large retail platform rather than remaining a paper deadline. The episode gives substance to earlier joint BaFin and Financial Intelligence Unit warnings about money-laundering and regulatory-circumvention risk clustering at the edges of grandfathering periods, where firms with large pre-existing customer books face a hard choice between meeting a harmonised EU standard or losing market access.

The refusal sits alongside continuing conventional AML/CTF enforcement. BaFin ordered Deutsche Bank AG on 15 September 2026, with the order finalised 6 October and announced 9 October 2026, to meet new deadlines for remedying deficiencies in its AML/CTF transaction-monitoring data-processing systems. This is the third such order since 2021, following earlier rounds in 2021 and 2023, and signals a persistence of structural weakness at a systemically important institution rather than a single remediable incident. Separately, BaFin fined abcfinance GmbH 90,000 for violations of the Geldwäschegesetz (GwG), specifically for filing several suspicious-activity reports late in relation to conduct in April 2025.

Other Developments

The EU AML Package continues its scheduled build-out. The GwG-Meldeverordnung (reporting regulation) has applied since 1 March 2026, the new EU Anti-Money Laundering Authority (AMLA) published its technical standards in July 2026, and by the end of 2026 AMLA is expected to have finalised standards and identified roughly 40 financial institutions that will move to direct European supervision from 1 January 2028. None of this is new movement this cycle so much as confirmation that the architecture is proceeding on its stated timetable.

Bitcoin Group SE is restructuring Bitcoin.de around external regulated partners. Following the MiCAR refusal, the company is finalising agreements with two separately-regulated German institutions, one to serve as trading counterparty and one as custodian, to resume trading for Bitcoin.des 1.1 million-plus registered users. futurum bank continues safekeeping existing client assets pending any transfer. No financial terms have been disclosed, and the arrangement remains under negotiation as of the most recent reporting.

A source discrepancy affects the FATF mutual-evaluation schedule for Germany. FATFs own assessment calendar lists Germanys next possible onsite evaluation period as 1 February 2029, while an older US State Department source stated a 2026 re-evaluation. The two sources are in direct conflict; FATFs own calendar is weighted as the authoritative record, and the discrepancy is recorded rather than resolved by assumption.

Cross-Monitor Connections

The futurum bank refusal is a shared data point across the integrity and payments-architecture lenses: the same enforcement event that signals AML/CTF-adjacent licensing risk to this brief also signals market-access and platform-continuity risk to payments-monitor readers tracking Germanys stablecoin and digital-money landscape, and signals a crypto-licensing-regime tightening to readers tracking token-level regulatory posture. The underlying fact, BaFins refusal and its date, is identical across those readings; what differs is which consequence each reader needs to act on. Separately, the continuing AMLA technical-standards process and the eventual identification of roughly 40 directly-supervised institutions is an architecture shift relevant to any reader tracking the locus of supervisory authority moving from purely national regulators toward a hybrid EU-level regime, a theme that recurs across jurisdictions in the EU AML Package rollout.

Outlook

The most immediate open question is whether futurum bank will lodge a formal appeal against the refusal, and whether BaFin will publish its own primary enforcement notice rather than leaving the record to rest on the issuer's ad-hoc disclosure. Absent either, the regulatory record for this specific action remains thinner than its market significance would suggest. The Deutsche Bank remediation order, now in its third iteration since 2021, bears watching for whether the bank meets the newly finalised deadlines or triggers a further escalation; a fourth order would materially change the read on whether this is a remediable control gap or a structural one. On the EU AML Package, the key date to watch is the end of 2026, when AMLA is expected to finalise its technical standards and name the roughly 40 institutions moving to direct supervision from 1 January 2028; Germany's eventual share of that list will be a significant signal of how the hybrid supervisory perimeter is drawn.

12 Oct 2026 · fim-2026-10-12

Lead Signal

The most structurally significant German development this cycle is BaFin's refusal of a MiCA crypto-asset service provider authorisation to Futurum Bank AG, the operator of bitcoin.de, disclosed by its parent Bitcoin Group SE on 6 October 2026. The refusal formalises an end to the supervisory toleration under which the platform had continued to operate after national KWG grandfathering expired at the end of 2025 and the EU-wide MiCA transition backstop closed on 1 July 2026; trading and deposits on the platform have in fact been suspended since 12 June 2026. Read against the standing MiCA authorisation gateway, this is a single-firm decision rather than evidence of a broader BaFin policy shift against crypto-asset platforms, but it is the clearest marker yet of how the MiCA transition period is resolving for firms that entered it without a clean authorisation pathway.

Other Developments

BaFin's guideline-publication format change. From 1 October 2026 BaFin began publishing a tabular overview of which EBA and AMLA European Supervisory Authority guidelines it has adopted, in place of the individual circulars it previously issued to confirm adoption. This is a procedural and administrative change to how adoption status is communicated, not a change to any underlying substantive obligation, and an English-language notice followed on 5 October 2026.

UniCredit's formal antitrust filing for Commerzbank. UniCredit S.p.A. has formally applied for European Commission antitrust clearance of its proposed acquisition of Commerzbank AG, announced 12 October 2026. UniCredit holds an economic interest representing approximately 47.6 percent of Commerzbank's share capital, and the Commission's review will assess market power across corporate lending, including German Mittelstand financing, deposits, and other banking products. The filing moves a long-watched structural question in German banking concentration into a formal regulatory review track, though the amount and precise terms of the proposed transaction have not been publicly disclosed.

Cross-Monitor Connections

The Futurum Bank refusal sits at the intersection of crypto-asset market structure and the AML/CTF perimeter: a firm losing its MiCA authorisation also loses standing as an EU-passported crypto-asset service provider, which has downstream implications for how counterparties assess its historical customer due-diligence record. The UniCredit-Commerzbank filing is a banking-structure development with no reported financial-crime dimension this cycle, but a transaction of this scale, once it proceeds past notification, typically generates downstream beneficial-ownership and group-structure review by supervisors. The BaFin guideline-table change is purely administrative and has no direct cross-monitor implication beyond the standing EU AML Package architecture described below.

Outlook

The Futurum Bank authorisation refusal and its resulting trading suspension warrant continued attention as EU crypto-asset supervisors complete the first wave of MiCA transition-period decisions through late 2026, since more borderline cases are likely to be resolved on broadly similar grounds. On the banking-structure side, the UniCredit-Commerzbank matter will progress through formal European Commission merger-control review, and the pace and substance of the Commission's market-power assessment will be the development to watch into 2027.

4 Oct 2026 · fim-2026-10-04

Lead Signal

Germany enters this cycle with its crypto-asset supervisory architecture settling into a mature, in-force posture rather than shifting through new rulemaking. Secondary reporting converges on a single structural picture: BaFin administers the largest population of Markets in Crypto-Assets Regulation (MiCA) crypto-asset service provider (CASP) authorisations anywhere in the European Economic Area, a position traceable to Germany closing its national transitional grandfathering window on 31 December 2025, well ahead of the EU-wide outer limit of 1 July 2026 under MiCA. Cited authorisation counts diverge across sources, ranging from roughly 53 to roughly 91 depending on the date and source consulted, and none of the figures have been cross-checked against the European Securities and Markets Authority's own CASP register this cycle, so the concentration is probable rather than confirmed in its precise scale. What is better supported is the direction of travel: commentary converges on intensifying BaFin AML supervisory scrutiny of crypto, fintech and payments institutions, including a reported increase in on-site inspections heading into 2026.

The architectural reading is that an early national cutoff functioned as a forcing mechanism, pulling CASP authorisation demand into Germany before the EU-wide deadline arrived, and that BaFin has paired that authorisation concentration with a corresponding supervisory response rather than treating licensing volume as a standalone achievement. A jurisdiction that authorises faster and in greater numbers than its peers, while simultaneously tightening scrutiny of the authorised population, is behaving differently from one that merely processes a licensing backlog.

Other Developments

Federal AML institutional consolidation continues. Germany's Bundesamt zur Bekaempfung von Finanzkriminalitaet (BBF) continues to progressively consolidate AML supervision, sanctions enforcement and financial-intelligence-unit functions under one federal roof, a structural move intended to replace the fragmented federal-state arrangement that FATF has previously criticised. This is corroborated across three independent lower-tier commentary sources, though no primary BaFin or Geldwaschegesetz (GwG) statutory text was retrieved this cycle to confirm the consolidation's exact current scope.

AMLA and AMLR milestones are now settled facts rather than forward expectations. The EU Anti-Money Laundering Authority (AMLA) has been operational in Frankfurt since 1 July 2025, and the directly applicable AML Regulation (Regulation (EU) 2024/1624, AMLR) applies from 10 July 2027. These dates carry Tier-1 sourcing for the AMLR application date via the EU's official legal database, giving this strand of the picture a firmer evidentiary footing than the authorisation-count or consolidation findings.

A procedural SAR-filing change remains unverified. A single lower-tier vendor source reports that suspicious activity reports must be filed exclusively via the goAML platform without delay, on the same or next working day, from March 2026, under the GwG Section 46(1) standstill duty pending financial-intelligence-unit clearance. This has not been corroborated against BaFin or FIU primary guidance this cycle and is carried at an uncertain confidence level accordingly.

Cross-Monitor Connections

The crypto-authorisation concentration finding sits directly adjacent to the Global Crypto Regulatory Monitor's own licensing-module findings for Germany, where the same KMAG Section 50 transitional-cutoff mechanism and MiCA CASP capital-threshold architecture are tracked in more granular form; this monitor's D5 reading is the AML-supervisory lens on the same underlying regulatory fact rather than a duplicate finding. The World Payments Monitor's standing coverage of German payment-institution licensing and the Wero instant-payments build-out is a related but distinct thread: both monitors are watching BaFin's capacity to supervise a fast-growing population of newly authorised or newly integrated firms, though the payments-monitor material this cycle concerns instant-payment wallets rather than crypto-asset service providers specifically. No conflict-finance, sanctions-evasion, or extractive-industry signal connecting to Germany was located this cycle, leaving those cross-monitor threads quiet for now.

Outlook

The near-term question for Germany's AML/CTF architecture is whether BaFin's reported increase in on-site inspection activity converts into a visible enforcement record against the newly authorised CASP population, which would supply the multi-cycle supervisory track record that is currently absent. Separately, the gap between reported authorisation counts (approximately 53 against approximately 91) is a research gap rather than a regulatory uncertainty, and resolving it against ESMA's own register would sharpen the confidence level of the concentration finding without changing its direction. The BBF consolidation and the AMLA/AMLR timeline are structural and multi-year in nature; neither is expected to generate a discrete near-term event, but both remain the backdrop against which any future German AML enforcement or supervisory development should be read.

28 Sep 2026 · fim-2026-09-28

Lead Signal

Germany's national KWG crypto-custody grandfathering regime expired on 31 December 2025, ahead of the EU-wide MiCA Article 143(6) backstop of 1 July 2026. Firms that had been operating under the national transitional permission but have not secured a granted MiCA CASP authorisation now operate illegally in Germany unless they hold a valid EU passport from another Member State. This is a structural narrowing of the AML-relevant regulatory perimeter for crypto-asset service providers: the German authorisation gap closes earlier than the EU minimum standard requires, meaning firms that assumed they had until mid-2026 to complete authorisation may already be operating outside the permitted perimeter.

Other Developments

EU AML Package transposition track for Germany continues on its staggered schedule without material acceleration or delay this cycle. Germany is bound directly by the AMLR (Regulation (EU) 2024/1624) from 10 July 2027 without need for national transposition, while 6AMLD (Directive (EU) 2024/1640) transposition proceeds in stages: FIU-access provisions by July 2025, beneficial-ownership register provisions by July 2026, and remaining provisions by July 2027. The GwG (Geldwäschegesetz) remains the operative German AML statute throughout this transition, with BaFin as supervisor and the FIU housed within the Generalzolldirektion. No T1 BaFin or Bundesanzeiger source confirming the DE-specific GwG amendment vehicle was retrieved this cycle, so this transposition-status account rests on secondary reporting.

Cross-Monitor Connections

The KWG grandfathering expiry is a shared signal with the crypto monitor's licensing-perimeter tracking: a firm outside the MiCA CASP authorisation perimeter is simultaneously outside the AML-obligated-entity perimeter that GwG supervision depends on, since German AML supervision of crypto-asset activity is structured around the same authorisation gate. This connects to world-payments only insofar as any payment-adjacent crypto custody arrangement loses its lawful basis at the same moment; no world-payments-specific finding was evidenced this cycle to corroborate a payment-flow dimension to this German development.

Outlook

Watch for BaFin enforcement activity against firms that remained active past the 31 December 2025 grandfathering cliff without a granted MiCA CASP authorisation or valid EU passport; the absence of any enforcement action reported to date against such firms is itself worth monitoring as a capacity or timing question. Watch also for confirmation, against a BaFin or Bundesanzeiger primary source, of the precise state of the DE-specific GwG amendment implementing 6AMLD's July 2026 beneficial-ownership register milestone.

13 Sep 2026 · fim-2026-08-16

Lead Signal

German financial-integrity architecture this cycle turns on a single point of convergence: an active sanctions-evasion enforcement case landing in the same window as a structural reordering of the federal AML architecture meant to catch such cases. A German-registered shell-company network is assessed to have delivered approximately thirty million euros in restricted goods to at least twenty-four Russian arms manufacturers since 2022, with five arrests recorded in February 2026 tied to the scheme. The finding rests on a single tier-three source and lacks a tier-one German prosecutorial confirmation this cycle, so it is carried at Assessed confidence rather than treated as adjudicated fact. What elevates this beyond a discrete enforcement item is its coincidence with confirmation, at High confidence and corroborated across a Bundestag record and independent legal-industry reporting, that the flagship consolidated anti-financial-crime authority of the federal government, the Bundesamt fur Bekampfung von Finanzkriminalitat established under the 2023 FKBG, has collapsed with the end of the Ampel coalition. In its place the government is pursuing a customs-centred alternative, the Zollfinanzgerechtigkeitsgesetz, expected to become largely effective from January 2027.

The analytical significance is architectural rather than incidental: an active evasion network operating through German corporate structures is surfacing at precisely the moment the institution designed to unify federal financial-crime capability has been abandoned in favour of an unproven customs-based model. Compounding the institutional picture, Germany is assessed to have missed the April 2025 deadline to transpose the EU Sanctions Crime Directive, Directive (EU) 2024/1226, leaving national corporate sanctions-liability standards below the EU-harmonised floor even as EU sanctions apply directly as a matter of law. Read together, these three data points describe a jurisdiction where enforcement capacity in one supervisory lane, BaFin, is intensifying while the structural reform lane of the government has stalled, and where implementation of a harmonising sanctions-crime instrument lags the deadline. This is the cycle lead signal precisely because it is a structural condition, not a single case.

Other Developments

Beneficial-ownership registry integration remains partially built out. The linkage between the Transparenzregister and the Grundbuch, established under the Sanktionsdurchsetzungsgesetz II, is assessed to persist as a stable structural feature of German corporate-transparency architecture. However, the planned Immobilientransaktionsregister, intended to extend transparency into real-estate transactions, is now institutionally unsettled following the collapse of the BBF, which had been slated to anchor it. The registry-linkage claim carries only tier-three sourcing for the live status of the planned register, meaning the assessment of its institutional home should be read as provisional pending confirmation from a primary German source this cycle.

Crypto-asset supervision in Germany is tightening ahead of the EU baseline. BaFin compressed the standard eighteen-month MiCA CASP transition window into a hard deadline of 31 December 2025, a materially stricter posture than most EU peers are assessed to have adopted. One visible consequence traced this cycle is Ethena Labs discontinuing German subsidiary operations and declining to pursue MiCA authorisation in Germany following BaFin scrutiny. Both findings are sourced to tier-three material only and are held at Assessed confidence; no tier-two or tier-one corroboration was located this cycle for either the deadline compression or the market-exit outcome.

Supervisory enforcement intensity is rising within the existing remit of BaFin. A record forty-five million euro fine against J.P. Morgan SE, imposed in October 2025 for AML control failures including untimely suspicious-activity-report filing, is corroborated across tier-two sources and held at High confidence. This sits alongside the creation by BaFin of a dedicated Anti-Financial-Crime division, effective 1 July 2026, consolidating AML, CTF and unauthorised-business supervision under one structure, also held at High confidence and corroborated by tier-two and tier-three material describing the same reorganisation.

Cross-Monitor Connections

The shell-company sanctions-evasion network carries direct relevance to SCEM conflict-finance and dual-use-procurement tracking, given its delivery of restricted goods to Russian arms manufacturers, a financial-architecture question that SCEM is better positioned to assess for downstream conflict-finance materiality. The missed transposition by Germany of the EU Sanctions Crime Directive is flagged for ESA EU sanctions-enforcement-divergence tracking, since a national implementation gap of this kind bears directly on cross-bloc harmonisation questions ESA monitors structurally rather than episodically. The pattern of BaFin enforcement activity together with the stalled BBF reform is flagged for WDM state-institution-integrity tracking: a national government abandoning its own consolidated financial-crime authority is a state-capacity signal distinct from, but adjacent to, state-capture analysis. The same BaFin enforcement intensity, including the scale of the J.P. Morgan fine, is separately flagged for GMM macro-financial-risk tracking, where wholesale and state-linked banking-sector AML enforcement carries transmission implications beyond the immediate supervisory action.

Outlook

Three regulatory-horizon items frame the medium-term trajectory. The AML Regulation and sixth AML Directive are set to become directly binding on German obliged entities from the third quarter of 2027, alongside a first work programme and supervisory methodology from AMLA expected in the fourth quarter of 2026 ahead of direct supervision of roughly forty cross-border institutions from January 2028. Domestically, the proposed Zollfinanzgerechtigkeitsgesetz, introducing administrative asset seizure for unclear-origin wealth without a criminal predicate, is assessed at low confidence given its early proposed stage and the unresolved question of whether a customs-centred model can replace the scope of the abandoned unified-agency design.

The standing key judgments this cycle read as follows. At High confidence, AML/CTF enforcement intensity in Germany is rising within the existing remit of BaFin even as the flagship structural reform has collapsed, producing a bifurcated institutional picture in which capability is consolidating in one supervisory lane while the broader architecture remains unsettled. At Assessed confidence, the compressed MiCA transition timeline is producing measurable market exit, indicating a stricter-than-EU-average crypto supervisory posture. Also at Assessed confidence, the missed transposition of the EU Sanctions Crime Directive constitutes a national-implementation lag leaving German corporate sanctions-liability standards temporarily below the EU-harmonised floor. None of these judgments should be read as forecasts of enforcement outcome; they describe the structural condition observed this cycle.

11 Aug 2026 · fim-2026-08-05

Lead Signal

The European Banking Authority completed the transfer of all its AML/CFT supervisory mandates to the new Anti-Money Laundering Authority on 1 January 2026, and AMLA has since published draft technical and implementing standards governing how it will select up to forty high-risk cross-border institutions for direct supervision from 2028, with a consultation window that closed 27 January 2026. This sits alongside a parallel structural shift in the beneficial-ownership regime: the AML Regulation moves the EU beneficial-ownership threshold to a flat standard of twenty-five percent or more ownership or control, with full application from 10 July 2027, embedding an Article 25 threshold and an Article 28(1) customer-due-diligence mandate across obliged entities bloc-wide. Read together, these are the most structurally significant EU AML-architecture developments of the year: supervision of Europe's largest cross-border institutions is moving from a purely national model toward a hybrid regime combining the directly applicable AML Regulation, the sixth AML Directive's national transposition layer, and AMLA's own direct and indirect supervisory perimeter, based in Frankfurt. For institutions domiciled in or operating through Germany, this is architecture, not incident: no single enforcement action this cycle matches the long-run significance of the mandate transfer itself.

Other Developments

Sanctions-evasion enforcement in Germany continued at volume. German federal prosecutors arrested five individuals in February 2026 in connection with a procurement network alleged to have exported more than thirty million dollars in dual-use goods to at least twenty-four Russian arms manufacturers since 2022, routed through shell companies; the pattern is corroborated across multiple press sources. Separately, a German public prosecutor's office secured convictions of two individuals for exporting one hundred and eleven luxury cars to Russia in breach of EU sanctions, with twenty million euros confiscated and jail sentences of six years and two years, the latter suspended. Internationally, OFAC added multiple individuals linked to the Ansarallah network to the Specially Designated Nationals List under Counter Terrorism Designations on 16 January 2026; no German-specific implication of that designation was independently verified this cycle, but it forms part of the same global sanctions-architecture picture against which German enforcement activity should be read.

Germany's MiCA transition reached its structural deadline. Grandfathered national, 5AMLD-era BaFin crypto-custody licences had to convert to full Markets in Crypto-Assets Regulation CASP authorisation by 31 December 2025. BaFin is now the sole CASP licensing authority in Germany under MiCA Articles 60 through 62 from 2026, closing the ambiguity window that had persisted for previously licensed custodians operating under the older national regime.

Cross-Monitor Connections

The dual-use export networks feeding Russian arms manufacturers sit at the intersection of this monitor's sanctions lens and the trade-finance and corporate-opacity concerns tracked by ERM and SCEM: procurement through shell companies is a trade-finance and beneficial-ownership problem before it manifests as a sanctions breach, and the fact that such networks persist notwithstanding sustained, well-publicised German enforcement illustrates how enforcement volume and architectural gap can coexist within the same jurisdiction. Germany's MiCA consolidation is, this cycle, primarily a market-structure and compliance-technology development with limited direct illicit-finance signal, but it expands the population of fully licensed, bank-adjacent obliged entities that AMLA's own eventual direct-supervision selection methodology will need to account for as crypto-asset service providers mature into the standard obliged-entity population. Taken together, the sanctions-evasion and beneficial-ownership-adjacent architecture developments this cycle are two views of the same underlying corporate-opacity problem, even where tracked here as separate domains.

Outlook

The AMLA consultation on its 2028 direct-supervision selection methodology closed 27 January 2026; the next milestone to watch is publication of AMLA's finalised technical standards and its first full work programme as the authority builds out its Frankfurt operations through 2026. The AMLR and sixth AML Directive application date of 10 July 2027 is the next hard deadline for Germany's beneficial-ownership regime, and no Tier-1 domestic transposition text for the accompanying GwG reform, which would bring financial holding companies into scope as obliged entities from 2027, has yet been located. On sanctions, the pattern of sustained prosecutorial activity against dual-use export networks and sanctions-breach schemes this cycle suggests continued enforcement volume is likely, though whether Germany's underlying export-control gatekeeping architecture is itself reformed in response remains an open question this monitor will continue to track alongside the maturing MiCA-licensed crypto-asset sector.

Domain intelligence (D1–D8)

D1 Sanctions

no_changestanding position

Sanctions Architecture and Evasion

The most consequential development for the German sanctions-evasion posture this cycle is prosecutorial rather than architectural in origin, but it exposes a structural weakness that has generated multiple, successive cases. Federal prosecutors disclosed in February 2026 the arrest of five men accused of routing more than thirty million US dollars in dual-use goods to at least twenty-four Russian arms manufacturers since 2022, using a chain of shell companies to disguise the ultimate destination of the exports. The finding is corroborated across independent Washington Post and Kharon reporting of the same arrests and is assessed at High confidence. Separately, German public prosecution authorities secured convictions against two individuals for exporting one hundred and eleven luxury vehicles to Russia in breach of EU sanctions, resulting in confiscation of twenty million euros and custodial sentences of six and two years, the latter suspended, though this finding rests on Tier 4 trade-press sourcing and is assessed rather than confirmed.

Continue reading

Read together, these two cases anchor the domain-tracker key judgment that Germany functions simultaneously as an enforcer of the EU sanctions regime and, structurally, as an enabler jurisdiction of concern for export-control circumvention, a judgment held at High confidence given the volume and pattern of prosecutorial activity clustering around shell-company export structures. The judgment is deliberately architecture-over-incident in framing: no single prosecution resolves the underlying gap, and the recurrence of similar shell-company and undervaluation patterns across multiple cases this cycle is the more analytically significant signal than any one conviction taken alone. The domain tracker records the German D1 trajectory as escalating rather than stable, reflecting sustained rather than episodic enforcement pressure, and marks the prior baseline as no longer stable.

The standing Russian Sanctions-Evasion Architecture tracker situates the arrests and conviction of this cycle within a wider pattern already under observation: a February 2026 ruling by the Court of Justice of the European Union on customs seizures, and a separate case involving an alleged front company based in Lubeck, are recorded on the same tracker as contributing to a picture of sustained enforcement activity against a persistent evasion architecture rather than an isolated cluster of unrelated cases. A draft knowledge-base patch generated this cycle proposes updating the standing German D1 position to record that Germany sustained active prosecutorial enforcement against Russia-sanctions-evasion networks this cycle, at High confidence; the patch remains in draft status pending ratification and is presented here as proposed rather than adopted standing position.

Beyond Germany, the addition on 16 January 2026 of multiple individuals linked to the Ansarallah network to the Specially Designated Nationals list, under the Counter Terrorism Designations authority of OFAC, is recorded as a global sanctions-architecture development at High confidence, sourced directly to OFAC. No German-specific implication of that designation was independently verified this cycle, and the interpreter has explicitly logged the absence of any parallel designation by the UK sanctions authority as a gap rather than assuming equivalence across regimes. This gap matters for the three-pillar balance this domain is required to maintain: the counter-terrorism-financing pillar risks being read as static this cycle relative to the AML-heavy export-control caseload, when in fact the absence of independently verified corroboration is the honest state of the evidence rather than a finding of no activity.

A further coverage gap is recorded on the sanctions-regime-divergence tracker: no new EU, US or UK autonomous-listing divergence event specifically implicating Germany was identified this cycle, and the German posture of implementing EU listings only, without unilateral national designations, is assessed as unchanged, though held at Low confidence given the absence of a positive source confirming stasis rather than mere silence. This distinction, between a confirmed no-change finding and an unconfirmed absence of evidence, is maintained deliberately rather than collapsed into a default assumption of stability.

Outlook

The near-term test for the German D1 posture is whether the pattern of successive shell-company and undervaluation prosecutions produces systemic remediation of the export-control gatekeeping gap, or whether enforcement continues to run reactively behind an evasion architecture that regenerates faster than individual cases can close it. The absence this cycle of a Tier 1 primary source specific to European Council designation activity on the Russia measures referenced in the luxury-car conviction, and the unresolved question of whether the UK sanctions authority will issue a designation paralleling the January action by OFAC against Ansarallah-linked individuals, are the two evidentiary gaps most likely to determine whether the next cycle assessment can move beyond the current mixed enforcement-and-enablement reading. Both gaps are logged in the gaps register rather than treated as resolved absences, consistent with the discipline that a documented gap is preferable to an assumed non-event.

Cumulative analysis

Sanctions Architecture and Evasion — Cumulative Analysis

Across the cycles tracked under the current jurisdiction chain, German sanctions-architecture posture has consistently combined two features that this cycle reaffirms rather than resolves: active prosecutorial enforcement against Russia-sanctions-evasion networks, and a structural reading of Germany as an enabler jurisdiction of concern for export-control circumvention notwithstanding that enforcement activity. The baseline established in the prior cycle centred on the activation, in the EU twentieth sanctions package adopted 23 April 2026, of the anti-circumvention instrument built into the EU restrictive-measures toolkit for the first time, including a sector-wide ban on new Russian and Belarusian crypto-asset service providers binding on German-licensed institutions from 24 May 2026, alongside a self-report by a major German bank of potential sanctions breaches involving Russian clients, and a compliance-timing gap in which a sanctioned exchange had already been designated by the US and UK sanctions authorities months before the equivalent EU designation followed.

This cycle extends that picture with a distinct enforcement cluster rather than a new architectural instrument. Federal prosecutors disclosed the arrest of five individuals accused of routing more than thirty million US dollars in dual-use goods to at least twenty-four Russian arms manufacturers since 2022 through a chain of shell companies, corroborated across independent press reporting and assessed at High confidence, and German public prosecution authorities separately secured convictions of two individuals for exporting one hundred and eleven luxury vehicles to Russia in breach of EU sanctions, with twenty million euros confiscated. Read against the prior-cycle baseline, these findings do not represent a new architectural gap so much as continued expression of the gap already identified: shell-company and undervaluation-based export circumvention persisting as a recurring pattern rather than an isolated case, now corroborated by a second and a third prosecutorial episode.

The standing Russian Sanctions-Evasion Architecture tracker, read cumulatively, now records a February 2026 ruling by the Court of Justice of the European Union on customs seizures and a separate front-company case in Lubeck alongside the export-network arrests and the luxury-car conviction, together supporting an escalating rather than stable trajectory across the tracked period. The domain-tracker key judgment that Germany functions simultaneously as enforcer and, structurally, enabler jurisdiction of concern is held at High confidence cumulatively, on the basis of the volume and recurrence of shell-company export patterns across multiple cycles rather than any single prosecution.

Set against this enforcement-side continuity, the global sanctions-list dimension shows a mixed but largely stable picture: the OFAC designation of Ansarallah-linked individuals on 16 January 2026 sits alongside a continuing absence of parallel designation activity by the UK sanctions authority specific to that network, and no new EU, US or UK autonomous-listing divergence event implicating Germany has been identified across recent cycles, a finding held at Low confidence reflecting an absence of positive evidence for stasis rather than confirmed non-divergence. The compliance-timing gap between the EU designation cadence and the OFAC and UK sanctions authority cadence remains an open structural question that this cycle neither confirms as resolved nor documents as recurring in a new instance.

The three-pillar balance discipline applied to this tracker continues to surface an under-weighted counter-terrorism-financing dimension relative to the AML-heavy export-control caseload: absent independently verified German-specific implication of the Ansarallah designation, the honest cumulative reading is one of a documented evidentiary gap rather than an assumption of no CTF-relevant activity in Germany. This gap has now persisted across the cycles in which the tracker has been maintained, and future cycles should treat it as a standing collection priority rather than a resolved non-finding.

Consistent with the enablement-as-signal principle governing this monitor, the absence of unilateral German sanctions designations, and the absence this cycle of a fresh EU Council primary source specific to the Russia measures referenced in the luxury-car conviction, are treated as analytically significant gaps rather than passed over in silence. Both gaps are logged in the interpreter gaps register and carried forward here as open items for the next cumulative update.

Cumulatively, the German D1 profile is best read as one in which structural EU-level instruments are advancing in parallel with, rather than in place of, a persistent domestic export-control enforcement gap. A draft knowledge-base patch generated this cycle to update the standing German D1 position remains in draft status, meaning the standing position has not yet been formally revised to reflect this cycle findings.

Outlook

The outstanding questions carried forward into the next cycle are whether the anti-circumvention instrument produces a designation or enforcement action against third-country transshipment infrastructure of the kind exposed by the export-network prosecution, whether the compliance-timing gap between EU and allied sanctions regimes narrows on future crypto-linked targets, and whether a parallel UK sanctions authority designation follows the OFAC action against the Ansarallah network.

domain_sub_briefs · D1 · Cumulative analysis
Standing baseline position

German shell-company network arrests (Feb 2026) mark continued Russia sanctions-evasion architecture risk in DE.

Germany D1 posture: active federal prosecution of dual-use export circumvention (EUR 30m); Deutsche Bank self-reported Russia-sanctions breaches to Bundesbank; EU 20th sanctions package anti-circumvention instrument now binding on German-licensed institutions.

Periodic updates (2)
13 Sep 2026 · fim-2026-08-16

Sanctions Architecture and Evasion

The sanctions-evasion-architecture picture in Germany this cycle is defined by a live enforcement case set against an unresolved national-implementation gap. A German-registered shell-company network is assessed, at present resting on a single tier-three source without tier-one German prosecutorial confirmation, to have used shell companies in Germany and elsewhere to export at least thirty million euros of restricted goods to no fewer than twenty-four Russian arms manufacturers since 2022, with five arrests recorded in February 2026. The standing Russian Sanctions-Evasion Architecture tracker for Germany is accordingly marked escalating and its baseline unstable this cycle, reflecting that this is an active case rather than a closed or historical one.

The architecture question this case raises is not simply whether shell companies were used, a mechanism well documented across the standing evasion-network literature, but what it reveals about the durability of corporate-registration controls in a jurisdiction with otherwise mature beneficial-ownership infrastructure. The Transparenzregister-Grundbuch linkage in Germany is a structurally sound piece of transparency architecture, yet a shell-company network reportedly moved thirty million euros in restricted goods over roughly four years before enforcement action materialised. That gap between architecture and enforcement outcome is the analytically load-bearing part of the finding, more so than the arrest count itself.

Compounding this, Germany is assessed to have missed the April 2025 deadline to transpose the EU Sanctions Crime Directive, Directive (EU) 2024/1226, into national law. This finding also rests on single-source trade-press reporting without a located tier-one confirmation from the federal justice ministry this cycle, so it is carried at Assessed rather than higher confidence. Substantively, EU sanctions themselves apply directly in Germany as a matter of EU law regardless of transposition status, so the immediate sanctions-compliance exposure for German firms is not obviously altered. What the missed deadline does affect is the national criminal-liability standard for sanctions breaches, the harmonised criminalisation framework the Directive was designed to establish, leaving the domestic corporate sanctions-liability regime in Germany below the EU-harmonised floor for a period whose duration is not yet resolved. The standing Sanctions Regime Divergence tracker is marked watch rather than escalating on this basis, reflecting that the divergence is one of national implementation rather than substantive sanctions-list content.

Read together, an active evasion case and an unresolved transposition gap describe a jurisdiction where the enforcement layer, arrests and designations under EU sanctions applied directly, is functioning, but the domestic legal-liability layer underpinning future enforcement is not yet fully aligned with the EU-harmonised standard. This is the architecture-over-incident reading the FIM register calls for: the case matters less as a single prosecution than as a data point on whether German sanctions-crime enforcement infrastructure can keep pace with evasion-network sophistication while a key harmonising instrument remains untransposed.

Outlook

The near-term trajectory for German sanctions architecture depends on two largely independent tracks. First, whether the February 2026 shell-company case produces a tier-one prosecutorial confirmation and conviction outcome that would upgrade the underlying claim beyond Assessed confidence and clarify the scale of the reach of the evasion network beyond the initial arrests. Second, whether Germany closes the EU Sanctions Crime Directive transposition gap; no horizon item specific to that transposition timeline was identified this cycle, meaning its resolution date remains unconfirmed. Neither the 2027 direct-application date of the AML Regulation nor the proposed Zollfinanzgerechtigkeitsgesetz customs-centred asset-seizure regime, expected around January 2027 at low confidence given its early proposed stage, directly resolves the transposition gap, though the latter could in principle create an administrative parallel-track mechanism for seizing proceeds of unclear-origin wealth connected to sanctions-evasion schemes, independent of whether the criminal-liability harmonisation question is settled. This is a structural observation about available mechanisms, not a prediction of how or whether either track will be used.

11 Aug 2026 · fim-2026-08-05

Sanctions Architecture and Evasion

Germany's sanctions-enforcement record this cycle is substantial in volume and reveals a persistent structural vulnerability in export-control gatekeeping. In February 2026, federal prosecutors arrested five individuals connected to a procurement network alleged to have exported more than thirty million dollars in dual-use goods to at least twenty-four Russian arms manufacturers since 2022, using shell companies to obscure the trade. This is a High-confidence finding, corroborated across multiple independent press sources reporting the same arrests, and it illustrates a pattern rather than an isolated incident: shell-company-mediated dual-use export evasion has been a recurring feature of the German sanctions-enforcement record, and the persistence of the pattern despite years of enforcement attention is itself the analytically significant fact, not any single arrest.

A second, separately sourced case reinforces the picture. A German public prosecutor's office secured convictions of two individuals for exporting one hundred and eleven luxury cars to Russia in breach of EU sanctions. The court confiscated twenty million euros and imposed jail sentences of six years and two years, the latter suspended. Sourced to trade-press reporting at Tier 4, this finding is held at Assessed rather than High confidence, but it is consistent with the same underlying pattern: goods evade sanctions controls through routine commercial channels rather than exotic financial instruments, and German enforcement, while active, is responding to volume rather than closing the underlying architecture gap.

Internationally, the sanctions picture this cycle also moved on the designation side: OFAC added multiple individuals linked to the Ansarallah, or Houthi, network to the Specially Designated Nationals List under Counter Terrorism Designations, effective 16 January 2026. No German-specific nexus to this designation was independently verified this cycle, and it is included here as structural backdrop to the global sanctions-architecture picture against which German institutions' own screening obligations operate, not as a German-specific finding.

Read together, the enforcement volume evidenced this cycle sits in tension with the persistence of the underlying evasion architecture: Germany continues to function simultaneously as an active enforcer against sanctions evasion and, structurally, as a jurisdiction through which evasion networks continue to operate. This is the architecture-over-incident reading this monitor applies: no single enforcement action resolves the underlying gap, and the recurrence of shell-company-mediated export evasion despite sustained prosecutorial attention is the higher-order signal.

The shell-company structures underlying the dual-use export network also illustrate the practical stakes of the beneficial-ownership reforms addressed elsewhere in this cycle's coverage: a procurement network capable of routing thirty million dollars in dual-use exports through corporate intermediaries for four years depends on exactly the kind of opaque corporate ownership that beneficial-ownership transparency reform aims to close. The sanctions-evasion and beneficial-ownership signals this cycle are, in that sense, two views of the same underlying architecture problem, even though they are tracked here as separate domains.

Sourcing discipline matters here: the dual-use export arrests are held at High confidence because multiple independent outlets reported the same underlying facts, while the luxury-car conviction, sourced to a single Tier 4 trade-press item, is capped at Assessed. This monitor renders that distinction faithfully rather than treating both cases as equally certain; the volume pattern is genuine, but individual-case confidence varies. The Ansarallah designation is also a reminder of this monitor's standing commitment to three-pillar balance: AML enforcement volume in Germany this cycle is substantial, but the CTF designation from OFAC is the cycle's clearest counter-terrorist-financing signal, and it is surfaced here even though its nexus to German institutions is not independently established, because CTF signals are structurally under-weighted relative to AML enforcement volume, and correcting for that bias is part of the analytical discipline this section applies.

Outlook

Continued prosecutorial activity against dual-use export and sanctions-breach networks in Germany should be expected given the pattern established this cycle; whether this translates into a structural reform of Germany's export-control gatekeeping, as opposed to continued case-by-case enforcement, is the open question this monitor will track. On the designations side, further OFAC, EU Council, or OFSI listing activity connected to the Ansarallah network or other conflict actors may generate downstream screening obligations for German institutions even absent a direct German nexus, and this monitor will continue to surface such designations as structural backdrop regardless of whether a German-specific enforcement action accompanies them.

D2 Beneficial Ownership

no_changestanding position

Beneficial Ownership and Corporate Transparency

Germany sits inside the direct perimeter of the EU AML Package, and the most structurally significant development for the German beneficial-ownership posture this cycle is accordingly an EU-level supervisory milestone rather than a domestic legislative change. The European Banking Authority completed the transfer of all its AML and CFT supervisory mandates to the Anti-Money Laundering Authority on 1 January 2026, and AMLA has since published draft technical and implementing standards, open for consultation to 27 January 2026, governing how it will select up to forty high-risk cross-border institutions, potentially including German-domiciled groups, for direct supervision from 2028. This finding is sourced directly to AMLA publication and assessed at High confidence.

Continue reading

The EU AML Package against which this cycle beneficial-ownership signal should be read is a three-instrument structural architecture rather than a single reform. It comprises the AML Regulation, directly applicable across Member States including Germany without domestic transposition, the sixth AML Directive, which requires transposition on a Member-State-by-Member-State basis, and the AMLA Regulation, which establishes the Anti-Money Laundering Authority itself and its direct and indirect supervisory perimeter over obliged entities. The practical effect of this architecture is a shift of supervisory authority away from purely national bodies such as BaFin, on a shared and hybrid basis, toward a partly EU-level regime, with AMLA assuming direct supervision of the highest-risk cross-border institutions while indirect supervision and coordination extend more broadly across the remaining obliged-entity population. This is a durable structural backdrop against which each cycle beneficial-ownership signal for Germany should be read, rather than a single-cycle development in its own right.

Within that backdrop, the German Transparenzregister faces a concrete threshold change under the AML Regulation this cycle: the beneficial-ownership disclosure threshold moves to twenty-five per cent or more, with full application from 10 July 2027, and the European Commission retains power to lower that threshold further for high-risk entity categories. A domestic reform proposal to the German Anti-Money Laundering Act, still resting on Tier 4 sourcing only, would bring financial holding companies into scope as obliged entities from 1 January 2027, though no Tier 1 or Tier 2 primary legislative text for that domestic proposal was located this cycle, and the finding is accordingly assessed rather than confirmed. This sourcing gap is logged explicitly rather than treated as an obstacle to reporting the development at all: the proposal is real enough to track, but its confidence tier reflects the absence of a primary parliamentary source.

The AML Regulation-driven threshold revision also carries FATF Recommendation 24 and 25 implications tracked on the standing Beneficial-Ownership Register Status tracker, which records the German Transparenzregister as facing expanded obligations under the incoming Regulation and Directive framework, with register-interconnection changes staged across 2026 and 2027. That tracker holds its overall trajectory as material change this cycle, at Assessed confidence, reflecting the concreteness of the threshold change set against the continuing absence of a primary source for the domestic obliged-entity expansion.

The German GwGMeldV mandate, in force from 1 March 2026, requiring fully digital, XML-format suspicious-activity-report filing via the goAML platform, functions as a parallel domestic transparency-infrastructure development, distinct from the beneficial-ownership register itself but relevant to the broader corporate-transparency ecosystem insofar as it affects how German obliged entities interact with the financial intelligence unit. A BaFin enforcement action against a German leasing company, which became legally binding on 5 May 2026 with a seventy-five thousand euro fine for undocumented non-filing decisions and late filing, illustrates the enforcement dimension of that same digital-reporting infrastructure, though this individual enforcement action is read here as illustrative of the broader digitisation requirement rather than as a freestanding beneficial-ownership finding in its own right.

Read against the enablement-as-signal principle, the absence this cycle of a documented sixth-Directive transposition vehicle specific to Germany is itself notable: the interpreter has explicitly declined to assume that transposition proceeds on schedule in the absence of a primary source, treating the gap as an open tracked item rather than a presumed non-issue. This caution is consistent with the broader discipline applied across this cycle: a proposed reform without primary-source confirmation is reported as proposed, not as adopted, regardless of how plausible its eventual enactment may appear.

Outlook

The German beneficial-ownership and corporate-transparency posture over the coming cycles will be shaped principally by two dates already fixed on the EU regulatory horizon: the AMLA Level 2 and Level 3 technical standards due by 10 July 2026, and the full application of the AML Regulation and the twenty-five per cent threshold from 10 July 2027. Whether AMLA finalises its direct-supervision selection methodology on schedule, and whether a Tier 1 primary source for the domestic German holding-company reform proposal emerges before the 1 January 2027 target date referenced in current reporting, are the two developments most likely to determine whether the current Assessed-confidence domestic finding can be upgraded in a future cycle.

Cumulative analysis

Beneficial Ownership and Corporate Transparency — Cumulative Analysis

This cumulative synthesis for the German beneficial-ownership and corporate-transparency domain draws on the interpreter structured output available this cycle; no prior cumulative essay for this domain was available to integrate, so this synthesis is seeded from the current cycle finding and should be read as the initial state-of-domain baseline for the current jurisdiction chain rather than as an update to an established multi-cycle essay.

Germany sits inside the direct perimeter of the EU AML Package, and the defining feature of the German beneficial-ownership posture as it stands is an EU-level supervisory architecture in transition rather than a settled domestic framework. The European Banking Authority completed the transfer of all its AML and CFT supervisory mandates to the Anti-Money Laundering Authority on 1 January 2026, and AMLA has since published draft technical and implementing standards, open for consultation to 27 January 2026, governing selection of up to forty high-risk cross-border institutions, potentially including German-domiciled groups, for direct supervision from 2028. This is assessed at High confidence, sourced directly to AMLA publication.

The EU AML Package against which the German signal should be read is a standing, three-instrument structural architecture: the AML Regulation, directly applicable across Member States including Germany without domestic transposition; the sixth AML Directive, requiring Member-State-by-Member-State transposition; and the AMLA Regulation, establishing the Anti-Money Laundering Authority itself and its direct and indirect supervisory perimeter. The practical effect is a shift of supervisory authority away from purely national bodies such as BaFin, toward a hybrid regime in which AMLA assumes direct supervision of the highest-risk cross-border institutions while indirect supervision and coordination extend across the remaining obliged-entity population. This is durable structural backdrop, not a single-cycle event, and should anchor every future cumulative update to this domain regardless of what specific German development surfaces in a given cycle.

Within that backdrop, the German Transparenzregister faces a concrete threshold change under the AML Regulation: the beneficial-ownership disclosure threshold moves to twenty-five per cent or more, with full application from 10 July 2027, and the European Commission retains power to lower the threshold further for high-risk entity categories. A domestic reform proposal to the German Anti-Money Laundering Act, resting on Tier 4 sourcing only, would bring financial holding companies into scope as obliged entities from 1 January 2027; no Tier 1 or Tier 2 primary legislative text for that proposal has yet been located, and the finding is assessed rather than confirmed. The standing Beneficial-Ownership Register Status tracker records the German Transparenzregister as facing expanded obligations under the incoming Regulation and Directive framework, with register-interconnection changes staged across 2026 and 2027, holding a material-change trajectory at Assessed confidence.

The German GwGMeldV mandate, in force from 1 March 2026 and requiring fully digital, XML-format suspicious-activity-report filing via the goAML platform, functions as a parallel domestic transparency-infrastructure development, and the BaFin enforcement action against a German leasing company, legally binding from 5 May 2026 with a seventy-five thousand euro fine for undocumented non-filing decisions and late filing, illustrates the enforcement dimension of that same digital-reporting infrastructure. These are read as illustrative of a broader digitisation requirement rather than freestanding beneficial-ownership findings.

Consistent with the enablement-as-signal principle, the absence of a documented sixth-Directive transposition vehicle specific to Germany is itself notable and is carried forward here as an open tracked item rather than a presumed non-issue, and a proposed domestic reform without primary-source confirmation is recorded as proposed, not adopted, regardless of plausibility.

Outlook

As this domain accumulates further cycles, the two fixed EU-level dates that should anchor future synthesis are the AMLA Level 2 and Level 3 technical standards deadline of 10 July 2026 and the full application of the AML Regulation and its twenty-five per cent threshold from 10 July 2027. Whether AMLA finalises its direct-supervision methodology on schedule, whether a Tier 1 source for the domestic German holding-company reform proposal emerges before its stated 1 January 2027 effective date, and whether a German sixth-Directive transposition vehicle is identified in a future cycle, are the three developments most likely to shape how this cumulative essay is revised going forward.

domain_sub_briefs · D2 · Cumulative analysis
Standing baseline position

Germany D2 posture: AMLR applies directly from 2027-07-10; 6AMLD transposition into German law not yet enacted (pending, staggered 2027-2029 deadline); TCSP sector market-entry licensing gap persists per FATF finding, unresolved since 2022 MER.

Periodic updates (2)
13 Sep 2026 · fim-2026-08-16

Beneficial Ownership and Corporate Transparency

Germany, as an EU/EEA member state, sits inside the direct perimeter of the EU AML Package, and its beneficial-ownership architecture is best read against that structural backdrop before any DE-specific development. The package comprises three distinct instruments: the AML Regulation (Regulation (EU) 2024/1624), which applies directly across all member states without national transposition; the sixth AML Directive, transposed individually by each member state; and the AMLA Regulation (Regulation (EU) 2024/1620), which establishes the Anti-Money Laundering Authority and shifts supervision from a purely national model toward a hybrid EU-level regime, with a direct-supervision perimeter for AMLA expected to cover a limited set of high-risk cross-border obliged entities from January 2028. This is durable structural context, not a single-cycle development, and it is the frame against which this cycle German BO signal should be read.

Within that frame, this cycle DE-specific signal is limited. The Transparenzregister-Grundbuch linkage, established under the Sanktionsdurchsetzungsgesetz II, is assessed to remain stable, connecting the beneficial-ownership register to land-registry data. The planned Immobilientransaktionsregister, an extension intended to bring real-estate transactions into the same transparency framework, now has an unsettled institutional home following the collapse of the BBF, the federal authority that had been positioned to anchor it. Both observations rest on tier-three sourcing only, and the live administrative status of the planned register could not be independently confirmed this cycle. Given the thinness of DE-specific BO and transparency signal this cycle beyond that single tracker item, this sub-brief is flagged for limited signal.

Outlook

The nearest confirmed horizon marker is the direct application of the AML Regulation and staggered sixth AML Directive transposition deadlines, most of which land in the third quarter of 2027, alongside a first work programme from AMLA expected in the fourth quarter of 2026. For German BO architecture specifically, the open question is institutional: whether the Immobilientransaktionsregister acquires a stable home under whatever successor arrangement follows the collapse of the BBF, or whether real-estate transparency integration stalls pending the broader Zollfinanzgerechtigkeitsgesetz build-out. No further DE-specific BO development was located this cycle, and this assessment should be read as a placeholder pending fresh reporting rather than a forecast of outcome.

11 Aug 2026 · fim-2026-08-05

Beneficial Ownership and Corporate Transparency

The EU's beneficial-ownership and corporate-transparency architecture rests on three distinct instruments, and this cycle's developments are best read against that durable structural backdrop. The AML Regulation, or AMLR (Regulation (EU) 2024/1624), is directly applicable across Member States without national transposition. The sixth AML Directive, or 6AMLD, requires transposition state by state. The AMLA Regulation (Regulation (EU) 2024/1620) establishes the Anti-Money Laundering Authority itself, which is progressively assuming a direct and indirect supervisory perimeter over obliged entities that had previously sat exclusively under national supervision. This three-instrument architecture is not a single-cycle development; it is the standing frame against which every beneficial-ownership and transparency signal in Germany and across the EEA should be read this cycle and in cycles to come.

Against that backdrop, this cycle carries two genuinely structural developments. First, the European Banking Authority completed the transfer of all its AML/CFT supervisory mandates to AMLA on 1 January 2026, and AMLA has published draft technical and implementing standards for its methodology for selecting up to forty high-risk cross-border institutions for direct supervision from 2028, with a consultation window that closed 27 January 2026. This is a High-confidence, Tier 1, AMLA-sourced finding, and it marks the practical beginning of the hybrid EU-level supervisory regime the three-instrument architecture above was designed to build. Second, the AMLR shifts the EU's beneficial-ownership threshold to a flat standard of twenty-five percent or more ownership or control, embedding an Article 25 standard with full application from 10 July 2027 and an accompanying Article 28(1) customer-due-diligence mandate.

Germany's own domestic beneficial-ownership register, the Transparenzregister, sits downstream of this EU architecture. A proposed domestic reform of the GwG would bring financial holding companies into scope as GwG-obliged entities from 1 January 2027, ahead of the AMLR's own full-application date. This domestic development, however, is sourced only to a Tier 4 compliance-vendor publication this cycle; no Tier 1 or Tier 2 German legislative or governmental primary source was located, and the finding is accordingly held at Assessed confidence rather than High. This is a genuine gap in this cycle's sourcing, not a signal that the reform is any less likely to proceed, and it is logged as such.

AMLA's own work programme, expected to reach a milestone in the third quarter of 2026, includes register-layer provisions and Level 2 and Level 3 technical standards due by 10 July 2026, ahead of the beneficial-ownership threshold's own full-application date the following year. This sequencing, technical standards preceding full legal application, is consistent with the AMLA build-out pattern already visible in the direct-supervision selection consultation, and it suggests the Authority is prioritising its own operational infrastructure ahead of enforcing the substantive thresholds it will eventually supervise.

The same corporate-opacity vulnerabilities that beneficial-ownership reform targets are visible in this cycle's sanctions-evasion enforcement: a dual-use export network capable of routing more than thirty million dollars through shell companies over four years depends on exactly the kind of ownership opacity the AMLR's lower, harmonised threshold is designed to close. The two domains are tracked separately in this monitor's structure, but the underlying architecture problem, corporate ownership that resists straightforward identification, is shared.

The practical implication for obliged entities domiciled in or operating through Germany is that beneficial-ownership due diligence is moving toward a materially lower and more harmonised ownership threshold, with a hardening EU-level supervisory backstop in AMLA sitting above the existing national framework, and a domestic register-scope expansion trailing close behind. None of this is yet fully binding, but the direction of travel across all three layers of the architecture is the same: broader scope, lower threshold, and a more centralised EU supervisory perimeter.

Outlook

The AMLR and 6AMLD application date of 10 July 2027 is the next hard deadline in this domain, and the Commission retains the power to lower the beneficial-ownership threshold further for high-risk entity categories, which would be a material development if it occurs before that date. AMLA's own build-out through 2026, including publication of its finalised direct-supervision selection technical standards, is the nearer-term milestone to watch, since it will determine which categories of cross-border institution, potentially including large German banks, fall within AMLA's direct rather than indirect supervisory perimeter. On the domestic side, this monitor will continue to seek a Tier 1 or Tier 2 primary source for the GwG financial-holding-company reform; until one is located, that specific finding will remain capped at Assessed confidence regardless of how many further Tier 4 sources report it.

D3 Enabler Jurisdictions

no_changestanding position

Enabler Jurisdictions and Professional Facilitators

No development specific to Germany as an enabler jurisdiction, distinct from the shell-company and undervaluation-based export-circumvention pattern already captured under the sanctions-architecture domain, was surfaced this cycle. The domain tracker records the German D3 status as watch rather than material change, with the baseline held stable and the key judgment supporting that reading held at Low confidence, reflecting an absence of dedicated D3 sourcing rather than a confirmed finding of no enabler-jurisdiction activity in Germany.

Continue reading

This is an honest coverage gap rather than a substantive null finding, and it is logged accordingly in the interpreter gaps register: dedicated searches for Tier D jurisdictions, and more specific enabler-facilitator research for Germany itself, were not independently run within the pooled search budget this cycle. The distinction matters under the enablement-as-signal principle governing this monitor: an absence of enforcement action, or of research coverage, in a jurisdiction previously assessed as carrying enabler-adjacent characteristics is itself potentially significant and should not be silently treated as evidence of stability.

The shell-company structures used in the dual-use export network disclosed this cycle, and the professional facilitation implicit in constructing that chain of entities, are the closest this cycle comes to a D3-relevant finding, but they are captured and traced under the sanctions-architecture domain rather than independently corroborated as a distinct enabler-jurisdiction development for Germany.

Outlook

The priority for the coming cycle is closing the dedicated D3 research gap for Germany rather than assuming continuity of the current watch status. Until a dedicated enabler-jurisdiction finding is surfaced or a confirmed no-change assessment is independently sourced, this domain should be read as thin-coverage rather than stable, and the next cumulative update should either resolve or explicitly re-flag this gap.

Cumulative analysis

Enabler Jurisdictions and Professional Facilitators — Cumulative Analysis

This is the first cumulative synthesis available for the German enabler-jurisdiction domain under the current jurisdiction chain, seeded from this cycle finding in the absence of a prior integrated essay. The state of this domain, as it stands, is defined more by a coverage gap than by a substantive finding: no dedicated enabler-jurisdiction development for Germany, distinct from the shell-company export-circumvention pattern captured under the sanctions-architecture domain, has been surfaced. The domain tracker records a watch status with a stable baseline, held at Low confidence, reflecting the absence of dedicated D3 research this cycle rather than a confirmed assessment of no enabler-jurisdiction activity.

Consistent with the enablement-as-signal principle, this cumulative essay treats the absence of dedicated coverage as itself worth recording rather than passing over in silence: a jurisdiction with prior enabler-adjacent characteristics that goes unresearched in a given cycle should not be read as having resolved those characteristics. The shell-company structures underpinning the dual-use export network disclosed this cycle illustrate a facilitation mechanism relevant to this domain conceptually, but they remain traced and reported under the sanctions-architecture domain rather than independently corroborated here.

Outlook

Future cumulative updates to this domain should prioritise closing the dedicated research gap identified this cycle, including the standing but unmet requirement to run Tier D jurisdiction searches, before any substantive change in the German D3 trajectory can be responsibly assessed. Until then, this essay will continue to record thin coverage rather than either a confirmed stable finding or a confirmed deterioration.

domain_sub_briefs · D3 · Cumulative analysis

D4 Conflict Finance

no_changestanding position

Conflict Finance and Extractive-Industry Integrity

No German-specific extractive-industry or conflict-finance finding, distinct from the sanctions-evasion and export-control cases captured under the sanctions-architecture domain, was located this cycle. The domain tracker records the German D4 status as watch, with a stable baseline held at Low confidence, and the interpreter has explicitly flagged this as a coverage gap rather than a confirmed no-change assessment: the absence of a finding reflects an absence of located sourcing, not a positive determination that no conflict-finance exposure exists.

Continue reading

The dual-use export network disclosed this cycle, which routed goods to at least twenty-four Russian arms manufacturers, carries an evident war-economy financing dimension and is flagged for cross-monitor attention on that basis, but it is traced and reported as a sanctions-architecture finding rather than as an independently corroborated extractive-industry or conflict-finance development specific to this domain. This caution reflects the broader discipline applied across this monitor: an unresearched domain is reported honestly as unresearched, rather than filled with adjacent findings repackaged to appear as dedicated coverage. The cross-monitor flag directing the dual-use export finding toward the conflict-finance monitor stands as the only substantive link between this domain and this cycle activity, and it should be read as a routing signal rather than as a German D4 finding in its own right.

Outlook

The priority for the coming cycle is running a dedicated D4 search for Germany rather than continuing to rely on overlap with sanctions-architecture findings. Until a distinct extractive-industry or conflict-finance signal for Germany is independently located, this domain should be read as thin-coverage, and the gap should be re-examined rather than allowed to default into an assumption of stability.

Cumulative analysis

Conflict Finance and Extractive-Industry Integrity — Cumulative Analysis

This is the first cumulative synthesis for the German conflict-finance and extractive-industry domain under the current jurisdiction chain, seeded from this cycle finding in the absence of a prior integrated essay. As it stands, this domain is defined by a persistent coverage gap rather than a substantive finding: no German-specific extractive-industry or conflict-finance development, distinct from the sanctions-evasion and export-control cases captured under the sanctions-architecture domain, has been located. The domain tracker records a watch status and stable baseline held at Low confidence, and this gap is treated as an open item rather than a confirmed no-change assessment.

The dual-use export network disclosed this cycle, supplying at least twenty-four Russian arms manufacturers, carries a war-economy financing dimension flagged for cross-monitor attention, but remains reported under the sanctions-architecture domain conceptually rather than as an independently corroborated D4 finding for Germany.

Outlook

Future cumulative updates should prioritise a dedicated D4 search for Germany before any substantive trajectory assessment can be made. This essay will continue to record thin coverage, consistent with the honesty-over-coverage discipline governing this monitor, until a distinct extractive-industry or conflict-finance signal for Germany is independently located.

domain_sub_briefs · D4 · Cumulative analysis
Periodic updates (1)
13 Sep 2026 · fim-2026-08-16

Conflict Finance and Extractive-Industry Integrity

No standalone D4 architecture development was identified for Germany this cycle; DE-specific conflict-finance and extractive-industry-integrity coverage remained thin. The one point of D4 relevance traces back to the D1-primary finding: the German shell-company network assessed to have delivered approximately thirty million euros in restricted goods to at least twenty-four Russian arms manufacturers since 2022 carries conflict-finance significance as direct materiel supply into an active war economy, even though the underlying finding is catalogued and analysed primarily under the sanctions-evasion-architecture domain rather than as a standalone extractive-industry or conflict-finance development. This sub-brief is flagged for limited signal accordingly; the facts underlying it are not new to this domain, but their conflict-finance dimension is worth surfacing explicitly given the three-pillar and cross-domain balance principle that CTF and conflict-finance-adjacent signals are otherwise structurally under-weighted relative to AML enforcement volume.

No German extractive-industry-specific finding, such as a mineral-supply-chain or resource-revenue-integrity development, was located this cycle. The absence of such a finding is itself worth noting rather than passed over silently, consistent with the enablement-as-signal principle: it indicates either genuine quiescence in this sub-domain for Germany this cycle, or a coverage gap in this cycle research pass, and the interpreter own coverage-gap register does not resolve which.

Outlook

Because the sole D4-relevant fact this cycle is the shell-company network already carried under D1, the forward-looking picture for German conflict-finance exposure tracks the same sanctions-evasion architecture trajectory: continued prosecutorial follow-through on the February 2026 arrests, and whether the case produces a tier-one prosecutorial confirmation that would upgrade the underlying claim confidence from Assessed. No independent D4 regulatory-horizon item was identified for Germany this cycle.

D5 Crypto / Digital Assets / Financial Innovation

no_changestanding position

Crypto, Digital Assets, and Financial Innovation

The German transition to the EU Markets in Crypto-Assets framework reached its structural deadline this cycle: grandfathered national, fifth-Directive-era BaFin crypto-custody licences had to convert to full Markets in Crypto-Assets Crypto-Asset Service Provider authorisation by 31 December 2025, and BaFin has been the sole licensing authority for crypto-asset service providers under Articles 60 to 62 of the Regulation from 2026. This finding rests on Tier 4 sourcing only and is accordingly assessed rather than confirmed, notwithstanding its structural significance for the German crypto-asset supervisory landscape.

Continue reading

This transition closes a period of licensing ambiguity in which crypto-custody providers operating under legacy national authorisation coexisted with the emerging Regulation-based Crypto-Asset Service Provider regime. With the conversion deadline now passed, BaFin functions as the single point of licensing accountability for crypto-asset service providers domiciled in Germany, a consolidation that the standing Crypto and Digital-Asset Integrity tracker records as a material change this cycle, held at Assessed confidence and supported by the domain-tracker key judgment that the transition is improving on the prior trajectory.

This domestic licensing consolidation should be read as the primary German-specific development in this domain this cycle, with the broader EU Markets in Crypto-Assets framework and the FATF virtual-asset standards functioning as contextual backdrop rather than as the lead story for the German position. The German BaFin gatekeeping function is the concrete, jurisdiction-specific supervisory fact; the EU-level regulation is the instrument that produced it, but the consolidation of licensing authority within BaFin is the German-specific consequence that this domain tracks.

This finding is tagged to the proliferation-financing pillar rather than the anti-money-laundering pillar, a classification that matters under the three-pillar balance discipline this monitor applies: CPF findings are structurally rarer than AML findings in enforcement-volume terms, and the completion of a licensing consolidation with proliferation-financing relevance should not be under-weighted simply because it generates no immediate enforcement action of its own. FATF Recommendation 15, governing virtual assets and virtual-asset service providers, is the relevant standard against which the German transition should be read, and the affected-firm-type scope recorded for this finding is crypto-asset operators specifically, distinguishing it from the cross-sector scope of most other German findings this cycle.

Adjacent to the licensing transition, the German GwGMeldV mandate for fully digital, XML-format suspicious-activity-report filing via the goAML platform, in force from 1 March 2026, is relevant to this domain insofar as crypto-asset service providers newly brought within the full authorisation perimeter are also subject to the same domestic reporting-digitisation requirements as other obliged entities, linking the crypto-specific licensing consolidation to the broader German AML-reporting infrastructure upgrade tracked elsewhere this cycle.

The wider AML Regulation, due for full application on 10 July 2027, extends anti-money-laundering customer due diligence obligations to crypto-asset service providers on the same footing as other obliged entities, meaning the licensing consolidation completed this cycle under the Markets in Crypto-Assets framework will shortly be joined by a parallel AML customer due diligence layer specific to German crypto-asset operators. This convergence of a licensing perimeter and a due diligence perimeter is the structural direction of travel for this domain over the next two years, and it is this convergence, rather than any single enforcement case, that should anchor the German D5 assessment going forward. No enforcement action against a specific German crypto-asset service provider was identified this cycle, and this absence should be read as consistent with a still-early post-conversion supervisory period rather than as evidence that the new authorisation perimeter is functioning without gaps.

Outlook

The near-term test for the German crypto-integrity posture is whether BaFin sole-gatekeeper status under the Markets in Crypto-Assets Regulation produces visible supervisory action, such as licence refusals, conditions, or enforcement, against crypto-asset service providers that fail to meet the converted authorisation standard, or whether the transition remains a largely administrative consolidation without a visible enforcement dimension in the near term. Whether a Tier 1 or Tier 2 primary BaFin source for the completed conversion becomes available in a future cycle, upgrading the current Assessed-confidence finding, is the second development most likely to shape how this domain evolves.

Cumulative analysis

Crypto, Digital Assets, and Financial Innovation — Cumulative Analysis

This is the first cumulative synthesis for the German crypto, digital-asset and financial-innovation domain under the current jurisdiction chain, seeded from this cycle finding in the absence of a prior integrated essay. As it stands, the domain is defined by the completed German transition to the EU Markets in Crypto-Assets framework: grandfathered national, fifth-Directive-era BaFin crypto-custody licences had to convert to full Crypto-Asset Service Provider authorisation by 31 December 2025, with BaFin now sole licensing authority under Articles 60 to 62 of the Regulation from 2026. This finding rests on Tier 4 sourcing only and is assessed rather than confirmed, notwithstanding its structural significance.

This transition closes a period of licensing ambiguity in which legacy national authorisation coexisted with the emerging Regulation-based regime, and the standing Crypto and Digital-Asset Integrity tracker records the consolidation as a material change, held at Assessed confidence, improving on the prior trajectory. The domestic licensing consolidation is treated as the primary German-specific development in this domain, with the broader EU Regulation and FATF virtual-asset standards read as contextual backdrop rather than the lead story for the German position specifically.

The finding is tagged to the proliferation-financing pillar rather than the anti-money-laundering pillar, a classification maintained cumulatively because CPF findings are structurally rarer than AML findings in enforcement-volume terms and risk being under-weighted for that reason alone. FATF Recommendation 15 is the relevant standard, and the affected-firm-type scope recorded is crypto-asset operators specifically. The German GwGMeldV mandate for fully digital suspicious-activity-report filing, in force from 1 March 2026, links the crypto-specific licensing consolidation to the broader domestic AML-reporting infrastructure upgrade, since crypto-asset service providers within the new authorisation perimeter are subject to the same reporting-digitisation requirement as other obliged entities.

Looking across the structural direction of travel for this domain, the AML Regulation, due for full application on 10 July 2027, will extend anti-money-laundering customer due diligence obligations to crypto-asset service providers on the same footing as other obliged entities, meaning the licensing consolidation completed this cycle will shortly be joined by a parallel due diligence layer specific to German crypto-asset operators. This convergence of a licensing perimeter completed now and a due diligence perimeter arriving in 2027 is the structural axis around which future cumulative updates to this domain should be organised, rather than around individual enforcement episodes as they arise. No enforcement action against a specific German crypto-asset service provider has yet been identified, and this absence should be read as consistent with an early post-conversion supervisory period rather than as evidence that the new authorisation perimeter is functioning without gaps.

Consistent with the architecture-over-incident principle governing this monitor, the structural fact of BaFin consolidated gatekeeping status is treated as more analytically significant than the absence of any individual enforcement case this cycle, and future updates should resist treating the eventual emergence of a single enforcement action as more significant than the underlying supervisory-perimeter shift that this cycle has recorded.

Outlook

Future cumulative updates to this domain should track two converging developments: whether BaFin sole-gatekeeper status produces visible supervisory action against crypto-asset service providers that fail to meet the converted authorisation standard, and whether the AML Regulation due diligence obligations for crypto-asset service providers, due by July 2027, are transposed into German supervisory practice without a further ambiguity window of the kind just closed. Whether a Tier 1 or Tier 2 primary BaFin source for the completed conversion becomes available, upgrading the current Assessed-confidence finding, is a third open item.

domain_sub_briefs · D5 · Cumulative analysis
Standing baseline position

BaFin refused futurum bank AG's MiCAR CASP authorisation (disclosed 6 Oct 2026), ending prior toleration and forcing Bitcoin.de into a partner-based restructuring.

Germany D5 posture: exposed to A7A5/Grinex ruble-stablecoin sanctions-evasion bridge; EU 20th package bans new Russian/Belarusian CASPs and applies sector-wide crypto measures from 2026-05-24, binding on BaFin-supervised entities; AMLR crypto obligations apply from 2027-07-10.

Periodic updates (6)
18 Oct 2026 · fim-2026-10-18

Crypto / Digital Assets / Financial Innovation

BaFins refusal of futurum bank AGs MiCAR CASP authorisation application is the defining crypto-integrity event of this cycle for Germany. The application had been under review since 27 June 2025; the refusal was disclosed on 6 October 2026, not through a BaFin-published primary enforcement notice but through Bitcoin Group SEs own mandatory ad-hoc disclosure as the parent of futurum bank. That provenance matters: the record of this refusal currently rests on the regulated issuer's own statement, not on BaFins own enforcement page, and no corroborating BaFin notice has yet been located.

What gives the refusal structural significance beyond the single firm is its timing against Germanys national MiCA transition design. Germany chose to end its own grandfathering period for pre-existing crypto-asset service providers on 31 December 2025, six months earlier than the EU-wide outer limit. That choice reflected an explicit policy judgment, shared in prior joint warnings from BaFin and the Financial Intelligence Unit, that extended toleration periods create money-laundering and regulatory-circumvention risk as firms with large legacy customer books continue operating under superseded national permissions while a harmonised EU licence is pending. The futurum bank refusal is the first concrete test of that judgment: a platform with more than 1.1 million registered users, operating under a toleration arrangement rather than a MiCAR authorisation, has now had that toleration withdrawn. This converts a previously abstract policy concern about end-of-transition risk into an observed enforcement outcome.

From an architecture-over-incident perspective, the material fact is not that one firm was refused a licence, but that the German transition design is shown to have real bite rather than functioning as a de facto indefinite extension. Firms elsewhere in the EU relying on national toleration periods that have not yet formally lapsed should treat this as a signal that national regulators accelerating their own cut-off dates intend to enforce them against incumbents, including large, customer-facing platforms, not only against newer or smaller entrants.

The consumer-facing consequence has been substantial: Bitcoin.de trading has been largely suspended, and the operator is now pursuing a partner model involving a separately-licensed trading counterparty and a separately-licensed custodian to resume service. This is a direct illustration of what happens commercially when a toleration period ends without an underlying authorisation in place: the firm cannot simply continue operating pending appeal, but must either restructure around already-licensed third parties or cease the activity. From a CTF and CPF-under-weighting standpoint, it is worth noting explicitly that no finding of money-laundering misconduct at futurum bank itself has been identified in the available evidence; this is a licensing-quality and application-sufficiency event, not a disclosed predicate-offence finding, and the typology significance lies in the structural end-of-transition pattern rather than in any specific illicit-finance conduct at this firm.

Germanys crypto-asset licensing data more broadly (authorisation counts, EURAU stablecoin issuance by AllUnity) sits with the crypto consumer and payments consumer for primary treatment; the financial-integrity lens here is specifically on what the refusal says about enforcement credibility at the end of a national transition window.

Outlook

The central open question is whether futurum bank lodges a formal appeal (Widerspruch) against the refusal within the applicable window, and separately whether BaFin publishes its own primary notice memorialising the refusal and its grounds. Either development would materially firm up the evidentiary record, which currently rests on a single-source issuer disclosure. If the partner-model restructuring (trading counterparty plus custodian) is finalised and disclosed with terms, that would confirm the market has absorbed the end of the toleration period without a full platform shutdown, reinforcing the enablement-vs-enforcement read that Germany is willing to enforce transition deadlines while leaving room for commercially negotiated continuity. Watch also for whether other EU member states with their own accelerated national grandfathering cut-offs produce comparable enforcement actions against incumbent platforms; a cluster of such actions would indicate a coordinated regulatory posture toward transition-period risk rather than an isolated German decision.

12 Oct 2026 · fim-2026-10-12

Crypto, Digital Assets, and Financial Innovation

Germany's crypto-asset supervisory picture this cycle is dominated by BaFin's refusal of a MiCA crypto-asset service provider authorisation to Futurum Bank AG, the entity operating the bitcoin.de exchange, disclosed by parent company Bitcoin Group SE on 6 October 2026. The refusal ends a period of supervisory toleration that had allowed the platform to continue offering crypto-asset services after the national KWG grandfathering deadline expired on 31 December 2025, and after the EU-wide MiCA transition backstop closed on 1 July 2026. Trading and deposits on the platform have been suspended since 12 June 2026, meaning the authorisation decision confirms rather than triggers the practical halt to the firm's crypto-asset activity.

The refusal is sourced to the regulated issuer's own ad-hoc disclosure as relayed by trade press, and BaFin's own decision notice has not been independently retrieved this cycle; it should be read as a single-firm authorisation decision rather than a confirmed signal of a broader BaFin posture toward crypto-asset platforms generally. It does, however, mark a concrete data point in how the MiCA authorisation gateway is resolving the backlog of firms that operated under national transitional regimes, and it falls within the standing Crypto/VASP Regulatory Framework tracker for Germany, which has moved to material change this cycle on the strength of this single development. The denial carries direct implications for the firm's standing as an EU-passported crypto-asset service provider and for how counterparties and affected customers assess the platform's wind-down.

Outlook

What to watch is whether BaFin's decision on Futurum Bank is representative of how other firms that relied on extended national transitional arrangements will be treated as the MiCA authorisation backlog clears through late 2026, and whether BaFin's own decision notice becomes available to confirm the grounds for refusal beyond the issuer's own disclosure.

4 Oct 2026 · fim-2026-10-04

Crypto, Digital Assets, and Financial Innovation

Germany's digital-asset regulatory footprint this cycle is defined less by a new rule than by the visible consequence of an earlier one. BaFin is reported to hold the largest population of MiCA crypto-asset service provider authorisations in the EEA as of September 2026, a position traceable to a national transitional-period cutoff of 31 December 2025 under KMAG Section 50, which closed Germany's own grandfathering window well ahead of the EU-wide outer limit of 1 July 2026. The practical effect of setting an earlier national deadline is to compress the authorisation decision for firms operating in or into Germany: providers that wished to continue serving the German market had to secure MiCA authorisation, or a valid EU passport from another member state, sooner than firms in jurisdictions that ran the transitional period to its full EU-wide length. That earlier deadline appears to have concentrated authorisation activity in Germany rather than dispersing it evenly across the bloc.

The precise scale of that concentration is not yet settled. Reported CASP counts for Germany range from approximately 53 to approximately 91 across the secondary sources available this cycle, a divergence wide enough that it should be read as a reporting-methodology or timing difference rather than as two competing accounts of the same fact measured identically. Neither figure has been checked against the European Securities and Markets Authority's own CASP register this cycle, so the finding is carried as probable rather than confirmed. What is more consistent across sources is the direction: Germany is not simply one of several comparably sized MiCA markets but a jurisdiction where authorisation activity has clustered disproportionately, for reasons tied specifically to its transitional-period design choice.

Alongside the authorisation picture, commentary reports heightened BaFin AML supervisory scrutiny of crypto, fintech and payments institutions heading into 2026, including a reported increase in on-site inspections. Read together, the two findings describe a jurisdiction where a large and recently authorised population of crypto-asset firms is being met with a corresponding rise in supervisory attention rather than being left to operate on the strength of its authorisation alone. This is the architecturally significant reading: a licensing regime's credibility rests not on how many firms it admits but on whether admission is followed by active supervision, and the early signals here point toward BaFin treating the two as linked rather than sequential.

For firms and counterparties assessing exposure to Germany's digital-asset market, the relevant structural fact is that the German MiCA regime is now a going concern rather than a transitional one. The national grandfathering period has closed, authorisation decisions have been made at scale, and supervisory posture is reported to be tightening rather than settling into routine maintenance. Counterparty risk assessments premised on Germany still being mid-transition are out of date; the more accurate framing is a jurisdiction with a large, newly authorised, and increasingly scrutinised CASP population.

Three-pillar balance is worth noting explicitly here: the available reporting this cycle speaks almost entirely to the AML pillar of supervisory scrutiny, with no counter-terrorist-financing or counter-proliferation-financing-specific finding surfaced for the crypto sector in Germany. That silence may simply reflect where secondary commentary chose to focus rather than an absence of CTF/CPF activity, and should not be read as evidence that CTF/CPF considerations are absent from BaFin's supervisory programme for crypto firms.

Outlook

The most consequential open question is whether BaFin's reported increase in on-site inspections produces a visible enforcement or remediation record against the newly authorised CASP population over the coming cycles. A jurisdiction that authorises quickly but shows no subsequent enforcement activity for an extended period invites a different kind of scrutiny than one that authorises quickly and then visibly supervises; Germany's trajectory on this point is not yet established. Resolving the authorisation-count divergence against ESMA's own register would also sharpen the picture, though that is a research-completeness matter rather than a regulatory development to watch. No change to the underlying legal framework is indicated by the available material; the current MiCA/KMAG architecture appears stable, with supervisory intensity rather than rulemaking the variable most likely to move in the near term.

28 Sep 2026 · fim-2026-09-28

Crypto, Digital Assets, and Financial Innovation

Germany's national KWG crypto-custody grandfathering regime expired on 31 December 2025, closing earlier than the EU-wide MiCA Article 143(6) backstop of 1 July 2026. This is the dominant D5 development for Germany this cycle: firms that relied on the national transitional permission to continue crypto-custody operations, but have not secured a granted MiCA CASP authorisation, now operate illegally in Germany absent a valid EU passport from another Member State. The practical effect is a compressed compliance window relative to firms operating under the EU-wide backstop timeline elsewhere in the bloc — a German-specific acceleration of the authorisation cliff rather than a change to the underlying MiCA framework itself.

From a financial-integrity perspective, the significance of this development is perimeter-based rather than incident-based: it is not that a specific illicit-finance event has been detected, but that the population of entities legitimately permitted to conduct crypto-custody business in Germany has narrowed, and any entity now operating outside that narrowed perimeter is, by definition, outside the AML-obligated-entity framework that German supervision of crypto activity depends on. This is exactly the kind of architecture-level finding that this monitor's framing principles direct attention toward: a structural shift in a well-regulated centre's authorisation gate is more analytically significant for financial-integrity purposes than a single enforcement action would be, because it changes the shape of who is inside and outside the regulated system, not merely who has been caught.

The absence of any evidenced enforcement action against firms that continued operating past the 31 December 2025 cliff without qualifying authorisation is itself a data point worth surfacing under this monitor's enablement-as-signal principle: non-enforcement in the period immediately following a perimeter-narrowing event is not neutral, and its absence from this cycle's evidence base should be read as an open question rather than as evidence that no such firms exist. Whether that absence reflects genuine full-compliance across the affected population, a supervisory lag, or a gap in this cycle's research budget is not resolvable from the evidence available this cycle.

The broader EU AML Package context is relevant background for interpreting this development, though it is tracked separately as its own D2 item: Germany's parallel position as bound directly by the AMLR from 10 July 2027, alongside staggered 6AMLD transposition through 2025-2027, means the crypto-perimeter narrowing described here is occurring against a backdrop of a wider AML architecture that is itself still assembling. A firm that loses its crypto-custody authorisation basis in Germany today is losing it under the existing GwG-based AML supervisory structure, not yet under the fuller AMLR/AMLA architecture that will apply from 2027 onward.

Outlook

The principal item to watch is whether BaFin surfaces any enforcement action against firms that continued crypto-custody operations past the 31 December 2025 grandfathering expiry without qualifying MiCA CASP authorisation or a valid EU passport. A first enforcement action in this space would meaningfully corroborate the perimeter-narrowing finding recorded this cycle and would move this item from a structural finding to a structural-plus-episodic one. Absent such an action, the next material marker is likely to be any BaFin public statement quantifying the number of firms that transitioned successfully versus those that did not, which would clarify whether the narrowed perimeter left a residual population of non-compliant operators of material size.

13 Sep 2026 · fim-2026-08-16

Crypto, Digital Assets, and Financial Innovation

The crypto-asset supervisory posture in Germany this cycle is defined by a materially stricter national implementation of an EU-wide framework. BaFin is assessed to have compressed the standard eighteen-month MiCA Crypto-Asset Service Provider transition window into a hard deadline of 31 December 2025, a tighter timeline than most EU peer jurisdictions are assessed to have adopted for the same transitional provision under MiCA Article 143(3). Both the deadline-compression finding and its consequence, Ethena Labs discontinuing its German subsidiary operations and declining to pursue MiCA authorisation in Germany following BaFin scrutiny, rest on tier-three sourcing only, with no tier-one or tier-two corroboration located this cycle, and are accordingly held at Assessed confidence rather than treated as fully verified.

The structural significance of this finding is that it demonstrates member-state-level supervisory discretion operating within a nominally harmonised EU framework. MiCA is designed to establish a single passportable authorisation regime for crypto-asset service providers across the EEA, but the transitional-period mechanics are left partly to national competent authorities, and the choice by Germany to compress that window ahead of most peers indicates BaFin is using available discretion to apply a stricter domestic standard than the EU baseline requires. The underlying claim is tied to a specific obligation reference, MiCA Article 143(3), a governance-type obligation applicable to crypto-asset operators, which anchors this finding to a discrete legal provision rather than general supervisory sentiment. The Ethena Labs exit is one visible data point consistent with that stricter posture and is catalogued against VASP-counterparty customer typology, though a single market exit is not on its own sufficient to establish a broader pattern of CASP flight from the German market; further corroboration would be needed to assess whether this is an isolated case or the leading edge of a wider trend.

This sits alongside broader BaFin enforcement priorities. The standing Crypto and Digital-Asset Integrity tracker for Germany notes that the 2026 supervisory priorities of BaFin name Travel Rule compliance as an enforcement focus, with at least seventy-five special examinations planned. Read together with the compressed CASP deadline, this describes a German crypto-asset supervisory environment that is tightening on two fronts simultaneously: the authorisation gateway, through the compressed transition deadline, and ongoing compliance monitoring, through the Travel Rule examinations. For crypto-asset operators considering or maintaining a German nexus, this is a jurisdiction-specific supervisory intensity signal distinct from the general EU MiCA baseline, and it should be read as such rather than conflated with pan-EU MiCA implementation generally.

This domain also connects to the standing sanctions-evasion architecture tracked elsewhere this cycle: crypto-asset channels are a recognised typology for sanctions circumvention generally, and a stricter German CASP authorisation and Travel Rule compliance regime is structurally relevant to closing off one potential evasion vector, even though no DE-specific crypto-sanctions-evasion case was identified this cycle. This is a structural observation about available channels, not a claim that such a channel was used in the German shell-company case discussed elsewhere in this brief, which involved conventional trade-based rather than crypto-based mechanisms.

The trajectory marked for this domain is escalating, with the baseline assessed as unstable, reflecting that both the deadline-compression policy and its market consequences are recent and still working through the system. No FATF grey-list action or broader jurisdictional-risk-direction change accompanies this finding; Germany remains off the June 2026 FATF grey-list update, so this is a domain-specific tightening rather than an indicator of broader jurisdictional risk deterioration.

Outlook

The forward-looking picture for crypto-asset supervision in Germany centres on whether the compressed CASP deadline of BaFin produces further market exits beyond Ethena Labs, and whether the planned seventy-five-plus Travel Rule special examinations materialise as described and what enforcement outcomes they produce. No specific regulatory-horizon item beyond the general EU AMLR and sixth AML Directive 2027 application timeline was identified as directly altering the German CASP authorisation regime this cycle. Given that both foundational claims in this domain rest on tier-three sourcing only, a priority for the next cycle is locating tier-one BaFin or tier-two supervisory-notice confirmation of the compressed deadline and its market effects, which would allow the confidence rating of this domain to move beyond Assessed. Absent that confirmation, this domain should continue to be read as a materially significant but evidentially thin signal.

11 Aug 2026 · fim-2026-08-05

Crypto / Digital Assets / Financial Innovation

Germany's MiCA transition reached its defining structural deadline this cycle: grandfathered national, 5AMLD-era BaFin crypto-custody licences had to convert to full Markets in Crypto-Assets Regulation CASP authorisation by 31 December 2025. BaFin is now the sole crypto-asset service provider licensing authority in Germany under MiCA Articles 60 through 62 from 2026, closing the ambiguity window that had persisted for custodians operating under the prior national licensing regime. This finding is sourced to a single Tier 4 source this cycle, and confidence is accordingly held at Assessed rather than High; no Tier 1 or Tier 2 BaFin or European Securities and Markets Authority primary publication confirming the transition mechanics was independently located.

Signal this cycle is limited to this single structural milestone. No new BaFin enforcement action, licensing refusal, or crypto-specific typology finding for Germany was located, and this sub-brief accordingly carries a limited-signal flag rather than a fuller architecture-and-incident treatment.

Outlook

The immediate question this monitor will track is whether BaFin publishes its own primary confirmation of the completed transition and the resulting population of fully MiCA-licensed CASPs in Germany, which would allow this finding to move from Assessed to High confidence. More broadly, the maturing population of MiCA-licensed, bank-adjacent crypto-asset service providers is the entity population AMLA's own eventual direct-supervision selection methodology may need to account for as it expands beyond traditional banks.

D6 Compliance Technology & Active Defence

no_changestanding position

Compliance Technology and Active Defence

The principal regulatory-technology and supervisory-technology signal for Germany this cycle is the GwGMeldV mandate, in force from 1 March 2026, requiring fully digital, XML-format suspicious-activity-report filing via the goAML platform. This digitisation requirement is anchored to a primary German financial-intelligence-unit and customs source and is treated as a structural compliance-technology development rather than an incidental process change, since it reshapes how all German obliged entities interact with the financial intelligence unit going forward. A BaFin enforcement action against a German leasing company, legally binding from 5 May 2026 with a seventy-five thousand euro fine for undocumented decisions not to file suspicious activity reports and for late filing, illustrates the compliance consequence of failing to meet reporting-infrastructure expectations, though the fine detail itself rests on lower-tier trade press and should be read as illustrative rather than as an independently verified compliance-technology finding in its own right.

Continue reading

The domain tracker records the German D6 status as watch rather than material change, reflecting that no distinct artificial-intelligence or machine-learning-specific supervisory guidance development was independently evidenced this cycle beyond the GwGMeldV digitisation mandate itself. This is logged as a coverage limitation rather than a confirmed absence of AI or machine-learning supervisory activity in Germany, consistent with the discipline of distinguishing an unresearched gap from a positively confirmed non-event.

Outlook

The near-term question for this domain is whether the GwGMeldV digitisation mandate produces measurable improvement in suspicious-activity-report quality and financial-intelligence-unit processing speed, or whether it functions primarily as a compliance-cost shift onto obliged entities without a corresponding supervisory-effectiveness gain. A dedicated search for German artificial-intelligence or machine-learning supervisory guidance, not undertaken this cycle within the available research budget, should be prioritised in the coming cycle to determine whether this domain genuinely remains quiet or whether coverage alone has been thin.

Cumulative analysis

Compliance Technology and Active Defence — Cumulative Analysis

This is the first cumulative synthesis for the German compliance-technology and active-defence domain under the current jurisdiction chain, seeded from this cycle finding in the absence of a prior integrated essay. As it stands, the domain is anchored to the GwGMeldV mandate, in force from 1 March 2026, requiring fully digital, XML-format suspicious-activity-report filing via the goAML platform, a structural compliance-technology development reshaping how German obliged entities interact with the financial intelligence unit. The BaFin enforcement action against a German leasing company, legally binding from 5 May 2026 with a seventy-five thousand euro fine for undocumented non-filing decisions and late filing, illustrates the compliance consequence of failing to meet reporting-infrastructure expectations, though this individual case rests on lower-tier sourcing and is read as illustrative rather than independently verified in its own right.

The domain tracker records a watch status, reflecting that no distinct artificial-intelligence or machine-learning-specific supervisory guidance development has been independently evidenced for Germany to date. This is treated cumulatively as a coverage limitation rather than a confirmed absence of activity, and future updates to this essay should either resolve this gap with a dedicated finding or continue to flag it explicitly rather than allow it to default into an assumption of a quiet domain.

Outlook

Future cumulative updates should track whether the GwGMeldV digitisation mandate produces measurable improvement in suspicious-activity-report quality and processing speed, and should prioritise a dedicated search for German artificial-intelligence or machine-learning supervisory guidance to determine whether this domain remains genuinely quiet or merely under-researched.

domain_sub_briefs · D6 · Cumulative analysis
Standing baseline position

Germany D6 posture: AMLA (Frankfurt seat) chair appointed January 2025; Authority formally operational since 2025-07-01 (corrected). Next-Generation FIU.net live since Feb 2025; BaFin digitalisation technical-support project ongoing.

Periodic updates (1)
12 Oct 2026 · fim-2026-10-12

Compliance Technology and Active Defence

BaFin changed how it communicates AML/CFT guideline-adoption status this cycle: from 1 October 2026, the authority began publishing a tabular overview of which European Supervisory Authority guidelines, issued under the EBA and now also AMLA, it has formally adopted, replacing the practice of issuing and consulting on individual circulars that merely confirmed adoption of each guideline in turn. An English-language version of the notice followed on 5 October 2026. This is reported through T3 trade commentary summarising a BaFin notice rather than through the notice itself, and it should be treated as an administrative and procedural change in disclosure format rather than any alteration to the substance of obliged entities' underlying AML/CFT duties.

The change sits inside the broader EU AML Package transition that is reshaping the compliance-technology and supervisory-communication landscape across the bloc: as AMLA's own guideline output grows alongside the EBA's, a single consolidated reference table is a lower-friction mechanism for obliged entities and their compliance functions to track adoption status than a running series of circulars, each requiring separate tracking. No change to reporting thresholds, record-keeping duties, or any compliance-technology vendor requirement was evidenced this cycle.

Outlook

The relevant development to watch is whether other national competent authorities across the EU adopt a similarly consolidated publication format as AMLA's own guideline output increases ahead of the 2027 direct-supervision selection cycle, and whether BaFin's own notice, once independently retrieved, confirms the scope of guidelines now covered by the table rather than by individual circular.

D7 AML/CTF Regime

no_change

AML/CTF Regime

Germanys AML/CTF and prudential supervisory apparatus produced three discrete enforcement actions in the 18 to 23 October 2026 window, each applying an existing power rather than signalling any change to the framework itself. BaFin withdrew the banking licence of Bank Saderat Iran's Hamburg branch and ordered it into wind-down, a licensing action against an Iranian-linked institution that sits adjacent to sanctions-related market-exclusion practice even though it is framed as a prudential and authorisation matter. The same regulator separately fined an unnamed natural person a total of EUR 12,000, split across two EUR 6,000 penalties, for breaching notification duties under the Wertpapierhandelsgesetz, a securities-disclosure obligation distinct from the core AML/CTF perimeter but enforced by the same supervisory authority. A third action, a public warning against an entity calling itself Mineral Resources Holdings and Commercial Investment Bureau operating through mraib.com, addressed the offering of banking business without the authorisation German banking law requires.

Continue reading

Taken together these three actions describe continuity rather than change. The licence withdrawal is the most structurally significant of the three because it removes a licensed banking foothold for an institution connected to Iran, a jurisdiction whose financial institutions have faced sustained supervisory scrutiny in Germany and across the EU. The notification-duty fines and the unlicensed-activity warning are of a more routine character: the former is a standing securities-market transparency tool, and the latter belongs to a familiar category of consumer protection action against unidentified operators soliciting business without the required licence. None of the three actions reflects a change to the GwG, KWG or related instruments; each is an application of standing supervisory authority. The instrument layer underlying sanctions, AML and market-abuse enforcement in Germany was not itself searched this period, so this account is limited to the enforcement actions BaFin made public rather than to any change in the underlying legal texts.

Outlook

The picture for Germany in this area over the near term is one of steady, active supervision rather than reform. The more consequential open question is what further disclosure accompanies the wind-down of Bank Saderat Iran's Hamburg branch, since a formal wind-down order of this kind sometimes surfaces additional detail about the scope of an institutions historical activity as the process proceeds. Whether BaFin's warning against the mraib.com operation leads to any identification of the entity behind it, or to a wider pattern of similar unlicensed solicitation being named, is a second thread worth tracking without anticipating any particular outcome. Absent a new instrument-level development, Germany's AML/CTF regime should be read as stable, with this periods activity sitting entirely within established enforcement practice.

Cumulative analysis

AML/CTF Regime

The AML/CTF regime in Germany this cycle presents a bifurcated institutional picture: rising supervisory enforcement intensity within the existing remit of BaFin, set against the collapse of the flagship structural reform of the government. At High confidence, corroborated by a Bundestag record and by independent reporting from ICLG alongside tier-three legal-blog commentary, the Bundesamt fur Bekampfung von Finanzkriminalitat, the consolidated federal AML authority established under the 2023 Finanzkriminalitatsbekampfungsgesetz, has collapsed with the end of the Ampel coalition. In its place, the government is pursuing a customs-centred alternative, the Zollfinanzgerechtigkeitsgesetz, expected to become largely effective from 1 January 2027, introducing administrative asset seizure for unclear-origin wealth without requiring a criminal predicate, a materially different institutional design from the unified-agency concept it replaces.

At the same time, and also at High confidence, BaFin has created a dedicated Anti-Financial-Crime division, effective 1 July 2026, consolidating AML, CTF and unauthorised-business-supervision functions that had previously sat across separate structures. This reorganisation is corroborated by two tier-two sources and one tier-three source describing the same institutional change. Enforcement records this cycle reinforce the picture of an active supervisory lane: a record forty-five million euro fine against J.P. Morgan SE, imposed in October 2025 for AML control failures including untimely suspicious-activity-report filing, is corroborated across tier-two sources at High confidence, and a separate binding remediation order against NordLB addressing an AML data backlog is recorded in the standing enforcement log, though at lower tier-three sourcing.

The structural reading is that the AML/CTF architecture in Germany is not moving in a single direction. BaFin, as the existing prudential and conduct supervisor, is visibly consolidating and intensifying its own AML/CTF capability, through a new division, a record fine, and binding remediation orders. Simultaneously, the broader ambition of the government to build a unified federal financial-crime authority spanning beyond the traditional remit of BaFin, which would have integrated customs, tax, and law-enforcement-adjacent functions into a single body, has been abandoned in favour of a narrower customs-centred asset-seizure mechanism. This is not necessarily a net deterioration; the existing lane of BaFin appears to be functioning and intensifying, but it does mean the more ambitious structural-reform vision for German financial-crime architecture, which would have addressed institutional fragmentation across agencies, has not materialised as originally designed. Whether the Zollfinanzgerechtigkeitsgesetz achieves comparable scope through a different institutional route, or represents a narrowing of ambition, is not yet assessable given its current proposed-stage status and low-confidence horizon rating.

This domain also intersects with the sanctions-transposition gap noted elsewhere this cycle: the missed deadline of Germany to transpose the EU Sanctions Crime Directive sits within the same broader national AML/CTF-institutional context as the collapse of the BBF, even though it is catalogued as a distinct legal-instrument issue. Both point toward the same structural observation, that supervisory enforcement capacity in Germany, through BaFin, and its legislative-institutional architecture, through BBF/Zoll and Sanctions Crime Directive transposition, are moving on different timelines and with different degrees of completion this cycle.

This bifurcation also carries relevance beyond the remit of FIM itself: the pattern of BaFin enforcement action together with the stalled BBF reform is flagged for WDM state-institution-integrity tracking, since a national government abandoning its own consolidated financial-crime authority is a state-capacity signal worth tracking independent of any state-capture question. The same enforcement intensity, including the scale of the J.P. Morgan fine, is separately flagged for GMM macro-financial-risk tracking, where wholesale and state-linked banking-sector AML enforcement carries transmission implications for broader financial-stability assessments.

Outlook

The forward-looking picture for the AML/CTF regime in Germany centres on three markers. First, whether the new Anti-Financial-Crime division of BaFin, once operational from 1 July 2026, produces a measurable change in enforcement cadence beyond the J.P. Morgan and NordLB actions already recorded. Second, whether the Zollfinanzgerechtigkeitsgesetz achieves its expected effective date around January 2027 and, if so, what scope of unclear-origin-wealth cases it captures relative to the abandoned BBF design; this horizon item is held at low confidence given its early proposed stage. Third, the EU-level backdrop: the AML Regulation and sixth AML Directive are set to become directly binding and substantially transposed respectively by the third quarter of 2027, with a first work programme from AMLA expected in the fourth quarter of 2026 ahead of direct supervision of cross-border institutions from January 2028, a hybrid EU-level supervisory layer that will sit above, rather than replace, the domestic BaFin-Zoll arrangement in Germany. None of these markers currently resolves whether the bifurcated institutional picture in Germany converges toward a more unified architecture or persists as a structurally divided regime.

domain_sub_briefs · D7 · Cumulative analysis
Standing baseline position

BaFin issued new AML remediation deadlines to Deutsche Bank AG (third order since 2021) and fined abcfinance GmbH €90,000 for late suspicious-activity reporting.

Periodic updates (1)
18 Oct 2026 · fim-2026-10-18

AML/CTF Regime

Germanys AML/CTF enforcement posture this cycle shows continuity on two long-running fronts rather than a single discrete event. BaFin ordered Deutsche Bank AG on 15 September 2026, with the order finalised 6 October and announced 9 October 2026, to meet new deadlines for remedying deficiencies in its AML/CTF transaction-monitoring data-processing systems. This is the third such order against the bank since 2021, following prior rounds in 2021 and 2023. The structural reading of this pattern is more significant than any single order: a systemically important institution receiving a third successive remediation order over a five-year span on the same underlying weakness, transaction-monitoring system deficiencies, suggests either that the remediation measures agreed in earlier rounds have proven insufficient or that the pace of required system change has not kept up with supervisory expectations. Either reading points to a structural rather than episodic compliance gap at one of Germanys largest banks.

Separately, BaFin fined abcfinance GmbH 90,000, announced 8 October 2026, for violations of the Geldwäschegesetz (GwG): specifically, several suspicious-activity reports were filed late, relating to conduct in April 2025. This is a smaller, more conventional enforcement action illustrating continued supervisory attention to reporting-timeliness obligations under the GwG even for non-bank obliged entities.

Against this enforcement backdrop, the standing EU AML Package architecture continues its scheduled build-out on an unremarkable timetable. The GwG-Meldeverordnung, a reporting regulation, has applied since 1 March 2026. The newly established EU Anti-Money Laundering Authority (AMLA) published its technical standards in July 2026. By the end of 2026, AMLA is expected to have finalised those standards and identified approximately 40 financial institutions across the EU that will move to direct European supervision from 1 January 2028, representing a structural shift of supervisory locus from purely national authorities toward a hybrid EU-level regime for the highest-risk cross-border institutions. None of this represents new movement this cycle in the sense of a surprising development; it is confirmation that a previously announced architecture is proceeding on schedule.

A notable evidentiary complication affects Germanys FATF standing: FATFs own assessment calendar lists Germanys next possible onsite mutual-evaluation period as 1 February 2029, while an older US State Department source had stated a 2026 re-evaluation. These two sources are in direct conflict. Consistent with the principle that a primary regulatory body's own published calendar should be weighted above a secondary government report citing an undated or superseded expectation, FATFs own calendar is treated as the more authoritative record here, though the discrepancy itself is recorded as a live uncertainty rather than silently resolved.

Outlook

The Deutsche Bank remediation order bears close watching: a fourth order, were one to follow, would be difficult to characterise as anything other than a structural failure to execute on repeated supervisory commitments, with corresponding implications for how the market and other regulators read Deutsche Banks control environment. On the EU AML Package, the key near-term date is the end of 2026, when AMLA is due to finalise its technical standards and name the roughly 40 institutions subject to direct supervision from 1 January 2028; whether and how many German institutions appear on that list will be an important signal for the shape of the EU-level supervisory perimeter as it affects German-headquartered or German-operating entities. The FATF evaluation-date discrepancy should be resolved as a priority in a future cycle by checking directly against FATFs calendar rather than carrying the conflict forward indefinitely.

D8 Commercial Activity

no_changestanding position

Commercial Activity

The standing commercial-activity item for Germany this cycle is UniCredit S.p.A.'s formal application for European Commission antitrust clearance of its proposed acquisition of Commerzbank AG, announced 12 October 2026. UniCredit already holds an economic interest representing approximately 47.6 percent of Commerzbank's share capital, and the European Commission's merger-control review will assess the transaction's effect on market power in corporate lending, including financing to the German Mittelstand, in deposit-taking, and in other banking products. The amount and currency of the underlying transaction have not been publicly disclosed, and the filing is reported through trade-press commentary rather than through the Commission's own notification record.

Continue reading

From a financial-integrity perspective, a transaction of this scale and structure is a commercial development to be read architecturally rather than as an incident: a successful acquisition would materially increase concentration in German banking, which has downstream relevance to the beneficial-ownership and group-structure mapping that obliged entities and supervisors maintain for large cross-border banking groups, and to the correspondent and corridor relationships Commerzbank maintains on behalf of its corporate clients. No financial-crime-specific finding attaches to the filing itself this cycle; it is tracked here as the standing structural development in German banking-sector commercial activity.

Outlook

The matter to watch is the progress of the European Commission's merger-control review and whether the Commission's assessment of market power in corporate lending and deposits surfaces any conditions bearing on group-structure transparency or correspondent-banking access as the review proceeds.

Regulatory horizon
Proposed1 Jan 2027 · ±quarter

Zollfinanzgerechtigkeitsgesetz — customs-centred asset-seizure regime (BBF replacement)

Introduces administrative asset seizure for unclear-origin wealth without a criminal predicate, replacing the abandoned BBF concept.
Source
In Force Pending2027-Q3 · ±quarter

AMLR / 6AMLD application date

AMLR becomes directly applicable, displacing fragmented national AML rulebooks for in-scope obligations.
European Union Source
2 dated · 4 pending date · baseline fim-2026-07-08
Role action cards
MLRO

BaFin withdrew the banking licence of an Iranian banks German branch and fined an individual for securities-notification breaches this period.

The licence withdrawal against Bank Saderat Irans Hamburg branch is the clearest sanctions-adjacent supervisory event of the period and warrants awareness for institutions with any historical correspondent exposure to that entity. The notification-duty fines are a reminder that BaFin continues to actively enforce disclosure obligations distinct from the core AML perimeter.

2 evidence refs
Compliance

Three BaFin enforcement actions this period, including a licence withdrawal and an unlicensed-banking warning, reflect active ongoing supervision rather than new rules.

None of the three actions changes a compliance obligation, but each confirms BaFin's continued willingness to use licensing withdrawal, monetary fines, and public warnings as live enforcement tools. Firms with any nexus to the named entities should note the actions.

3 evidence refs
Legal

BaFin's licence withdrawal against Bank Saderat Iran's Hamburg branch carries a formal wind-down order.

The wind-down order creates a defined legal process for the branch's exit from the German market; counterparties with contractual exposure to the branch face a changed legal posture as the order proceeds.

1 evidence refs
Board

Germanys financial supervisor removed the licence of an Iranian-linked bank branch and issued two other enforcement actions this period.

None of the three actions reflects a change to Germany's regulatory architecture; they represent continuity of supervisory posture rather than a strategic-level shift requiring board attention beyond awareness.

1 evidence refs
CTO

No material change for this persona this cycle.

No material change for this persona this cycle

Risk

BaFin's three enforcement actions this period sit within established risk categories rather than signalling a new typology.

The licence withdrawal against an Iranian-linked bank branch is the most structurally significant of the three for exposure-concentration purposes; the other two actions are routine disclosure and unlicensed-activity enforcement.

3 evidence refs
Operations

No material change for this persona this cycle.

No material change for this persona this cycle

Audit

BaFin's public warning against an unlicensed banking-business website identifies a specific operator name for monitoring purposes.

The warning against Mineral Resources Holdings and Commercial Investment Bureau and the mraib.com website provides a documented reference point for any audit trail check against unauthorised-entity screening lists.

1 evidence refs
Standing trackers (T1–T6)
TrackerStatusNote
T1 · Sanctions Exposurematerial_changeOwnership-aggregation rule and new universal reporting duty.
T2 · Beneficial Ownership Transparencystable
T3 · Enabler/Gatekeeper Supervisionstable
T4 · Conflict Finance / Supply Chainstable
T5 · Crypto / Digital Assetsstable
T6 · Sanctions Regime Divergencestable
Registers

Enforcement actions

  • 28 Jan 2026
  • 30 Jan 2026
  • 17 Apr 2026
  • 2 Feb 2026
  • 5 Nov 2025
  • 28 Jan 2026
  • 30 Jan 2026
  • 17 Apr 2026
  • 2 Feb 2026
  • 5 Nov 2025
  • 5 May 2026
  • 2 Mar 2026
  • 1 Oct 2025
  • 14 Jun 2026
  • 15 Sep 2026
  • 11 Sep 2026
  • 15 Sep 2026
  • 8 Oct 2026
  • 22 Oct 2026
  • 21 Oct 2026
  • 21 Oct 2026
  • German prosecutors searched Deutsche Bank offices in Frankfurt and Berlin over a money-laundering probe into historic transactions (2013-2018) linked to firms tied to sanctioned oligarch Roman Abramovich, including alleged delayed suspicious activity reporting. 28 Jan 2026
  • A previously unreported second AML probe against Deutsche Bank was confirmed by prosecutors, originating from a May 2025 search whose seized documents produced new investigative leads. 30 Jan 2026
  • Deutsche Bank reported cases of potential sanctions breaches involving Russian clients to Germany's central bank, the Bundesbank, indicating internal identification of possible compliance failures. 17 Apr 2026
  • Germany's federal prosecutor ordered the arrest of five men for allegedly exporting goods worth at least EUR 30 million to Russia in breach of EU sanctions on dual-use/controlled items. 2 Feb 2026
  • German police made multiple arrests breaking up an alleged $350 million fraud and money-laundering network operating through payment firms, with suspicion that some staff, including executives, knowingly cooperated with fraudsters. 5 Nov 2025

Sanctions changes

  • 23 Oct 2025
  • 23 Apr 2026
  • 23 Oct 2025
  • 23 Apr 2026
  • 16 Jan 2026
  • The EU's 19th sanctions package (23 Oct 2025) targeted Russian energy, third-country banks and crypto providers, including the Grinex exchange and A7-linked entities, directly applicable to Germany as an EU Member State via BaFin/Bundesbank enforcement. 23 Oct 2025
  • The EU's 20th sanctions package (23 Apr 2026) moved from entity-level to sector-level designations, banning any new Russian crypto-asset service provider and activating, for the first time, the EU's anti-circumvention instrument against third-country infrastructure; crypto measures apply from 24 May 2026 and bind German-licensed CASPs and banks. 23 Apr 2026

Regulatory horizon (register)

  • AMLA Work Programme / build-out
  • AMLR / 6AMLD application date
  • Zollfinanzgerechtigkeitsgesetz — customs-centred asset-seizure regime (BBF replacement)
  • AMLA Work Programme / build-out
  • AMLA direct-supervision preparatory milestone
  • AMLR / 6AMLD full application
  • AMLA direct supervision of ~40 selected financial institutions
  • AML Regulation (AMLR) direct application across Germany
  • 6AMLD transposition into German national law
  • AMLA direct-supervision selection and transfer, Frankfurt seat
  • Germany's next FATF progress report / 5th-round evaluation

Active schemes

  • Dual-use export circumvention networks routing goods to Russia
  • German real-estate market as laundering conduit
  • TCSP sector nominee/shell structuring gap
  • [HIGH] Ruble-stablecoin bridge for Russia sanctions evasion
  • Hamas-linked financing flows disrupted by German FIU
Sources
  1. Deutsche Bank: Lawbreaking Likely in Russian Laundromat | OCCRP
  2. https://www.washingtonpost.com/world/2026/02/02/germany-sanctions-evasion-five-arrested/
  3. https://www.zoll.de/SharedDocs/Downloads/DE/Links-fuer-Inhaltseiten/Fachthemen/FIU/fiu_goaml_registrierung_hinweise.pdf
  4. https://www.amla.europa.eu/amla-takes-major-step-toward-harmonised-eu-supervision_en
  5. https://zavia.ai/germany-beneficial-ownership-register-transparenzregister-ubo-data-access-restrictions-and-the-2027-reset/
  6. https://rue.ee/crypto-licence/germany/
  7. https://www.cps.gov.uk/cps/news/organisations-must-prepare-now-new-fraud-prevention-law
  8. https://ofac.treasury.gov/recent-actions/20260116
  9. https://www.lexology.com/library/detail.aspx?g=0c0cbf34-810f-4fc3-95bf-eefb7abad0eb
  10. https://www.kharon.com/resources/article/export-controls/russia-sanctions-and-export-controls-compliance-in-2026-detecting-evasion-networks-and-layered-ownership
  11. https://www.lexology.com/library/detail.aspx?g=15decca4-8204-44c2-ab0a-045f8ba514a4
  12. https://www.bafin.de/EN/die-bafin/die-bafin_node_en.html
  13. https://legal.pwc.de/en/news/articles/bafin-publishes-its-2026-risks-in-focus
  14. https://rechtsanwaltkaufmann.de/wirtschaftsstrafrecht/bundesamt-finanzkriminalitaet-bbf
  15. https://www.bundestag.de/presse/hib/kurzmeldungen-982360
  16. https://iclg.com/practice-areas/anti-money-laundering-laws-and-regulations/germany/
  17. https://www.fatf-gafi.org/en/countries/detail/Germany.html
  18. https://checklynx.com/en/resources/knowledge-base/fatf-grey-list
  19. https://yellow.com/news/germany-crypto-regulation-startups
  20. https://www.cyfrin.io/blog/mica-regulation-explained-a-guide-to-eu-crypto-compliance
  21. https://www.bundesfinanzministerium.de/Content/EN/Standardartikel/Topics/Europe/War-in-Ukraine/implementation-of-the-sanctions-on-russia.html
  22. https://germancomplianceinstitute.com/blogs/news/german-money-laundering-law-gwg-explained-key-rules-you-must-know-2026-edition
  23. https://iclg.com/practice-areas/anti-money-laundering-laws-and-regulations/germany/amp
  24. https://eco.com/support/en/articles/14814632-mica-stablecoin-regulation-2026-update
  25. https://www.techtimes.com/articles/322828/20260803/germanys-bafin-orders-nordlb-fix-aml-data-backlog-landesbank-crackdown.htm
  26. FATF
  27. RegPulse
  28. FATF
  29. independent AML/OSINT commentary
  30. Ondato
  31. Financial Regulations EU
  32. Crassula
  33. Regmantle
  34. German Compliance Institute
  35. hoge.gg
  36. EUR-Lex
  37. AML Intelligence
  38. BaFin
  39. RegReportingDesk
  40. AMLA
  41. Behind Fintech
  42. Bitcoin.com (DE)
  43. https://www.bafin.de/DE/unternehmen-maerkte/aufsicht/alle-unternehmen/geldwaesche/geldwaesche_node.html
  44. https://www.fatf-gafi.org/en/calendars/assessments.html
  45. https://www.rosepartner.de/blog/geldwaeschepraevention-2026-meldeverordnung-sorgfaltspflicht.html
  46. https://www.kerberos-compliance.com/wissen/blog/geldwschepraevention-2026-diese-fristen-und-neuerungen-muessen-verpflichtete-kennen
  47. https://www.onvista.de/news/2026/10-06-eqs-adhoc-bitcoin-group-se-bafin-verweigert-beantragte-micar-zulassung-der-futurum-bank-ag-0-37-26561212
  48. https://www.bafin.de/
  49. https://certaby.com/knowledge/sanctions-ownership-and-control-50-percent-rule
  50. https://financialcrime.lu/2025/09/11/EU-Sanctions-Helpdesk-Ownership-and-Control/
  51. https://schulz-beratung.de/awg-novelle-2026-40-mio-bussgeld-compliance-exportkontrolle/
  52. https://www.sk-berater.com/fileadmin/user_upload/Content/%C3%84nderungen_des_Au%C3%9Fenwirtschaftsgesetzes_2026_%E2%80%93_versch%C3%A4rfte_Regelungen.pdf
  53. https://www.awv-meldepflicht.de/ratgeber/awv-meldepflicht
  54. https://beglaubigt.de/blog/transparenzregister
  55. https://www.tappmeier.de/transparenzregister/
  56. https://onlinebilanz.de/transparenzregister-pflicht-eintragung-bussgeld/
  57. https://www.stmi.bayern.de/media/a-z/geldwaesche/Basismerkblatt-gwg.pdf
  58. https://www.wpk.de/fileadmin/documents/Beruf/Geldwaesche/WPK-Bekaempfung_der_Geldwaesche-Anwendungshinweise.pdf
  59. https://lxgesetze.de/gwg/15
  60. https://mweke.brandenburg.de/media/bb1.a.3814.de/Basisinformation_GwG.pdf
  61. https://lxgesetze.de/gwg/17
  62. https://www.buzer.de/17_GwG.htm
  63. https://dejure.org/gesetze/GwG/2.html
  64. https://www.rak-hamburg.de/f/53ae352f21.pdf
  65. https://www.brak.de/anwaltschaft/berufsrecht/geldwaeschepraevention/
  66. https://paytechlaw.com/finanzkriminalitaetsbekaempfungsgesetz/
  67. https://www.gesetze-im-internet.de/lksg/BJNR295910021.html
  68. https://dcycle.io/de/blog/lksg/
  69. https://www.bafin.de/SharedDocs/Veroeffentlichungen/DE/Fachartikel/2024/fa_bj_0701_MiCAR.html
  70. https://hoge.gg/de/mica-deutschland-2026-bafin-casp-lizenzen-sonderweg/
  71. https://www.anwalt.de/rechtstipps/kmag-was-das-kryptomaerkteaufsichtsgesetz-fuer-casps-in-deutschland-bedeutet-254683.html
  72. https://www.traub.legal/themen/bank-kapitalmarktrecht/kryptoverwahrung-erlaubnispflicht-micar/
  73. https://www.anwalt.de/rechtstipps/micar-lizenz-deutschland-2026-der-vollstaendige-leitfaden-fuer-krypto-anbieter-269321.html
  74. https://nexvyra.de/fakten/bafin-kryptoverwahrgeschaeft-erlaubnis.html
  75. https://www.finance-loop.net/knowledge-hub/travel-rule/
  76. https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELEX%3A32023R1113
  77. https://dev.to/viktoriia_mykhalchuk/the-eus-zero-threshold-crypto-travel-rule-what-small-transfers-require-28g9
  78. Bundesministerium der Justiz (gesetze-im-internet.de)
  79. Bundesministerium der Justiz (gesetze-im-internet.de)
  80. BaFin
  81. lxgesetze.de (GwG consolidated text)
  82. lxgesetze.de
  83. lxgesetze.de
  84. Kerberos Compliance
  85. ccompliance.de
  86. Bundesministerium der Justiz (gesetze-im-internet.de)
  87. Bundesministerium der Justiz (gesetze-im-internet.de)
  88. SK Berater
  89. Schulz Beratung
  90. awv-meldepflicht.de
  91. ccompliance.de
  92. Kanzlei Tholl
  93. anwalt.de
  94. anwalt.de
  95. nexvyra.de
  96. Legal Tribune Online (LTO)
  97. BaFin
  98. lawplayer.com
  99. Wikipedia
  100. Bundesministerium der Justiz (gesetze-im-internet.de)
  101. ccompliance.de
  102. lawcode.eu
  103. Rose Partner
  104. Germany
  105. Mutual Evaluation of Germany
  106. Mutual Evaluations
  107. Consolidated assessment ratings
  108. Assessments
  109. Publications
  110. Consolidated Processes and Procedures for Mutual Evaluations and Follow-Up Universal Procedures
  111. The FATF Recommendations
  112. High-risk and other monitored jurisdictions
  113. Outcomes of meetings
  114. Germany's measures to combat money laundering and terrorist financing
  115. GERMANY 1. How to find out if a natural or legal person ...
  116. 1 Germany Implementing the UN Global Counter-Terrorism Strategy
  117. Deutsche Bank Faces Other AML Probe, German Prosecutors Confirm - Bloomberg
  118. Anti-money laundering and countering the financing of terrorism at international level - Finance
  119. Germany's progress in strengthening measures to tackle money laundering and terrorist financing
  120. Financial Action Task Force Identifies Jurisdictions with Anti-Money Laundering, Combating the Financing of Terrorism, and Counter-Proliferation Finance Deficiencies | FinCEN.gov
  121. Alerts/Advisories/Notices/Bulletins/Fact Sheets | FinCEN.gov
  122. Frankfurt to host the EU’s new anti-money laundering authority (AMLA) - Consilium
  123. Commission welcomes the selection of Frankfurt as the seat for the Authority for Anti-Money Laundering and Countering the Financing of Terrorism
  124. Anti-money laundering and countering the financing of terrorism overview - Finance
  125. Anti-money laundering and countering the financing of terrorism at EU level - Finance
  126. About AMLA - Authority for Anti-Money Laundering and Countering the Financing of Terrorism
  127. Timeline: EU action against money laundering and terrorist financing - Consilium
  128. FAQs - Authority for Anti-Money Laundering and Countering the Financing of Terrorism
  129. Anti-money laundering: Council and Parliament agree on procedure to select seat for new authority - Consilium
  130. Anti-money laundering: Council adopts package of rules - Consilium
  131. Questions and Answers: The new EU Anti-Money Laundering Authority (AMLA)
  132. Exporting dual-use items - Trade and Economic Security
  133. Germany Arrests Five Over Sanctions-Busting Exports to Russia
  134. Russian Harmful Foreign Activities Sanctions | Office of Foreign Assets Control
  135. 1 Preventing Russian Export Control and Sanctions Evasion:
  136. EU sanctions against Russia: questions and answers - Consilium
  137. Sanctions Programs and Country Information | Office of Foreign Assets Control
  138. Preventing Russian export control and sanctions evasion - Updated guidance for industry - Finance
  139. EU adopts 20th package of sanctions against Russia - Finance
  140. Timeline - EU sanctions against Russia - Consilium
  141. The EU's 20th sanctions package targets the architecture of crypto sanctions evasion
  142. Civil Penalties and Enforcement Information | Office of Foreign Assets Control
  143. Enforcement Actions | FinCEN.gov
  144. Mutual Evaluation of Germany
  145. MUTUAL EVALUATION REPORT OF GERMANY
  146. Germany Uncovers $350 Million Fraud Tied to Payment Firms - Bloomberg
  147. Report: German Real Estate is a Money Laundering Haven | OCCRP
  148. A Small-Scale Con Exposes Deutsche Bank’s Lack of Oversight | OCCRP
  149. German Police Raid Property Tied to Russian Oligarch Alisher Usmanov; Tax Evasion and Money Laundering Suspected | OCCRP
  150. Report: German Real Estate is a Money Laundering Haven
  151. With Deutsche Bank’s help, an oligarch’s buying spree trails ruin across the US heartland - ICIJ
  152. Tax raids across Germany sparked by Panama Papers, Offshore Leaks - ICIJ
  153. Germany - Reform Support - European Commission
  154. Fight against money laundering and terrorist financing - Consilium
  155. 2025 Crypto Regulatory Round-Up
  156. Germany - Reforms and Investments - European Commission
  157. Supporting reforms in Germany TSI 2022 - European Commission
  158. German Anti-Money Laundering Agency Gets Needed Overhaul | OCCRP
  159. 'Next-Generation' FIU.net - Finance - European Commission
  160. The potential economic impact of the reform of Germany’s fiscal framework - Economy and Finance
  161. FIU.net - European Commission
  162. Development of Financial Intelligence Unit’s expertise focused on digital finance and virtual assets - Reforms and Investments
  163. United Nations Partnership with Financial Intelligence Unit Germany Highlights Innovative Software Tools Used to Combat Organized Crime | Meetings Coverage and Press Releases
  164. German Medium- Term Fiscal- Structural Plan 2025 – 2029
  165. Documents - Financial Action Task Force (FATF)
  166. Kampf gegen Finanzkriminalität
  167. Governance - Germany | Interoperable Europe Portal
  168. German Draft Budgetary Plan 2025 - Economy and Finance
  169. 7.2 Administration and governance - National Policies Platform
  170. German Prosecutors Raid Deutsche Bank in Money Laundering Probe | OCCRP
  171. Deutsche Bank Offices Inspected by Frankfurt Prosecutor in Ongoing Probe - Bloomberg
  172. Deutsche Bank Reports Itself to Regulator Over Russia Clients
  173. German prosecutors drop probe into Deutsche Bank ties to Estonian dirty money scandal - ICIJ
  174. US Investigators ‘Expand Deutsche Bank Money-Laundering Probe’ into Russian Trades | OCCRP
  175. German Prosecutors Drop Money Laundering Probe Into Deutsche Bank | OCCRP
  176. Deutsche Bank Probes: Lax Money-Laundering Controls, Market Rigging and More
  177. Deutsche Bank: Lawbreaking Likely in Russian Laundromat | OCCRP
  178. Federal Ministry of Finance (Germany)
  179. FATF (Mutual Evaluation of Germany)
  180. FATF (Germany Follow-Up Report)
  181. European Commission (DG FISMA)
  182. Council of the European Union (Consilium)
  183. Bloomberg
  184. OCCRP / Transparency International
  185. Elliptic
  186. Germany national report to UN Sixth Committee
  187. UNODC / G20 Anti-Corruption Resources
Coverage gaps
fim-int-2026-07-07-G001: Baseline provenance states an 18-mo…
fim-int-2026-07-07-G001: Baseline provenance states an 18-month lookback window ending 2026-07-05 but every enforcement action and recent development cited falls within a 3-6 month window (Nov 2025-Apr 2026); evidence from the first 12 months of the stated window is absent and would resolve this temporal-coverage inconsistency. [resolved]
fim-int-2026-07-07-G002: No official Frankfurt prosecutorial…
fim-int-2026-07-07-G002: No official Frankfurt prosecutorial statement naming Roman Abramovich in connection with the Deutsche Bank raid was located; an official case filing or prosecutorial press statement would confirm or disconfirm the media-reported link. [resolved]
fim-int-2026-07-07-G003: No post-2020 quantified estimate of…
fim-int-2026-07-07-G003: No post-2020 quantified estimate of illicit capital flows through German real estate was located; an updated Transparency International/OCCRP or BKA figure would allow reassessment of the scheme's current severity. [resolved]
fim-int-2026-07-07-G004: Germany's next FATF progress report…
fim-int-2026-07-07-G004: Germany's next FATF progress report or 5th-round mutual evaluation has no confirmed date on the FATF assessments calendar; a scheduled date would sharpen the T3 tracker's forward-looking confidence. [resolved]
fim-int-2026-07-07-G005: AMLA's first supervisory methodolog…
fim-int-2026-07-07-G005: AMLA's first supervisory methodology and work-programme documents have not yet been published in retrievable form; their publication would substantiate the fim-reg-2026-050 horizon item beyond Assessed confidence. [resolved]
fim-int-2026-07-07-G006: No evidence was located on whether …
fim-int-2026-07-07-G006: No evidence was located on whether Germany has moved to close the FATF-identified TCSP market-entry licensing gap since the 2022 Mutual Evaluation; a BaFin or Federal Ministry of Finance policy statement would clarify current status. [resolved]
fim-int-2026-08-05-G001: Tier D (Cambodia, Laos, Mexico, Col…
fim-int-2026-08-05-G001: Tier D (Cambodia, Laos, Mexico, Colombia) dedicated searches were not independently run this cycle within the pooled search budget. [resolved]
fim-int-2026-08-05-G002: No DE-specific extractive-industry …
fim-int-2026-08-05-G002: No DE-specific extractive-industry (D4) finding distinct from the sanctions-evasion/export-control cases was located this cycle. [resolved]
fim-int-2026-08-05-G003: No Tier-1 primary German legislativ…
fim-int-2026-08-05-G003: No Tier-1 primary German legislative text was located for the domestic GwG reform draft (financial holding companies obliged from 2027). [resolved]
fim-int-2026-08-05-G004: No new EU/US/UK autonomous-listing …
fim-int-2026-08-05-G004: No new EU/US/UK autonomous-listing divergence event specifically implicating Germany (T6) was identified this cycle. [resolved]
fim-int-2026-08-16-G001: Tier-D jurisdictions (KH, LA, MX, C…
fim-int-2026-08-16-G001: Tier-D jurisdictions (KH, LA, MX, CO) not actively researched this cycle — pooled union budget prioritised DE-scoped queries. [resolved]
fim-int-2026-08-16-G002: No T1 europa.eu/amla.europa.eu prim…
fim-int-2026-08-16-G002: No T1 europa.eu/amla.europa.eu primary anchor located for AMLR/6AMLD/AMLA standing-tracker instruments this cycle. [resolved]
fim-int-2026-08-16-G003: No T1/T2 confirmation of a distinct…
fim-int-2026-08-16-G003: No T1/T2 confirmation of a distinct 2022 FATF review of Germany referenced in secondary German-language sources, versus the 2009/2010 MER on fatf-gafi.org. [resolved]
fim-int-2026-08-16-G004: D6 (Compliance Technology and Activ…
fim-int-2026-08-16-G004: D6 (Compliance Technology and Active Defence) DE-specific supervisory AI/ML transaction-monitoring guidance not located this cycle. [resolved]
fim-int-2026-08-16-G005: UN Panel of Experts (Yemen) / OFAC …
fim-int-2026-08-16-G005: UN Panel of Experts (Yemen) / OFAC / OFSI Houthi-linked designation channels not actively checked this cycle for a DE nexus. [resolved]
fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', 'value': 'D1'}): No substantive D1 sanctions-architecture finding surfaced for Germany this cycle. [resolved]
fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', 'value': 'D4'}): No substantive D4 conflict-finance finding surfaced this cycle. [resolved]
fim-int-2026-09-28-G003: Tier D coverage for Mexico and Colo…
fim-int-2026-09-28-G003: Tier D coverage for Mexico and Colombia yielded no fresh material this cycle within budget; recorded as a coverage gap, not a no-material-change finding. [resolved]
fim-int-2026-09-28-G004 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-28-G004 ({'scheme': 'financial_integrity', 'value': 'D2'}): 6AMLD transposition status for the DE-specific GwG amendment vehicle was not confirmed against a T1 BaFin/Bundesanzeiger source this cycle. [resolved]
fim-int-2026-10-04-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-04-G001 ({'scheme': 'financial_integrity', 'value': 'D1'}): No DE-specific D1 (sanctions architecture/evasion) finding was located this cycle; a BaFin or OFSI/OFAC/EU-Council update naming a DE-specific sanctions-evasion channel would resolve this. [resolved]
fim-int-2026-10-04-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-04-G002 ({'scheme': 'financial_integrity', 'value': 'D3'}): No DE-specific D3 (enabler jurisdictions/professional facilitators) finding was located this cycle. [resolved]
fim-int-2026-10-04-G003 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-04-G003 ({'scheme': 'financial_integrity', 'value': 'D4'}): No DE-specific D4 (conflict finance) finding was located this cycle. [resolved]
fim-int-2026-10-04-G004: Tier D jurisdictions (KH, LA, MX, C…
fim-int-2026-10-04-G004: Tier D jurisdictions (KH, LA, MX, CO) were not independently refreshed this cycle within the DE-bound research pass; this is a coverage gap, not a no-material-change finding. [resolved]
fim-int-2026-10-04-G005 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-04-G005 ({'scheme': 'financial_integrity', 'value': 'D7'}): Germany's 6AMLD transposition status and the exact AMLA direct-supervision perimeter for DE-domiciled obliged entities were not independently re-verified this cycle. [resolved]
fim-int-2026-10-04-G006 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-04-G006 ({'scheme': 'financial_integrity', 'value': 'D5'}): Exact MiCA CASP authorisation count for Germany diverges between sources (approximately 53 vs 91); an ESMA register cross-check would resolve this. [resolved]
fim-int-2026-10-12-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-12-G001 ({'scheme': 'financial_integrity', 'value': 'D1'}): No Germany-specific Russian sanctions-evasion development identified this cycle; T1 tracker coverage for Germany is thin. [resolved]
fim-int-2026-10-12-G002: No Germany-specific jurisdiction ri…
fim-int-2026-10-12-G002: No Germany-specific jurisdiction risk movement data was available from research this cycle. [resolved]
fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', 'value': 'D1'}): Russian sanctions-evasion architecture tracker (T1) was not independently reached for Germany-specific channels this cycle; shared search budget was scoped to Germany-specific domains. [resolved]
fim-int-2026-10-18-G002: Tier D jurisdictions (KH, LA, MX, C…
fim-int-2026-10-18-G002: Tier D jurisdictions (KH, LA, MX, CO) were not actively searched this cycle; the union pass was scoped to Germany. [resolved]
fim-int-2026-10-18-G003 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-18-G003 ({'scheme': 'financial_integrity', 'value': 'D5'}): No BaFin-published primary enforcement notice for the futurum bank AG MiCAR refusal was located this cycle; the fact rests on the issuer's own mandatory ad-hoc disclosure. [resolved]
fim-int-2026-10-23-G001: AML/CFT, sanctions and market-abuse…
fim-int-2026-10-23-G001: AML/CFT, sanctions and market-abuse instrument-layer searches (GwG, KWG market-abuse provisions, sanctions enforcement via BAFA/Zollkriminalamt/FIU) were not run this cycle; search budget was spent on other consumer domains. [open]
fim-int-2026-11-01-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-01-G001 ({'scheme': 'financial_integrity', 'value': 'D4'}): Conflict-minerals/extractive transparency (D4), proliferation-financing-specific duties, and compliance-technology supervisory expectations (D6) were not reached within the Station-1 research budget for this cycle. [open]
fim-int-2026-11-01-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-01-G002 ({'scheme': 'financial_integrity', 'value': 'D2'}): Nominee/bearer-share disclosure (D2) and information-sharing gateways/UWO deadlines were not reached within the Station-1 research budget. [open]
fim-int-2026-11-01-G003 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-01-G003 ({'scheme': 'financial_integrity', 'value': 'D1'}): Sectoral trade sanctions detail beyond the general AWG/AWV framework was not reached within the research budget. [open]
FIM-GAP-001 (D2): Germany's Transparency Register (Transpare…
FIM-GAP-001 (D2): Germany's Transparency Register (Transparenzregister), introduced in 2017, remains underutilized by real-estate agents and notaries who are obligated gatekeepers, with historically very low suspicious-transaction reporting from that sector relative to overall inflows of dubiously-sourced capital into property.
FIM-GAP-002 (D3): Germany's AML/CFT supervisory system spans…
FIM-GAP-002 (D3): Germany's AML/CFT supervisory system spans over 300 supervisors across financial and non-financial sectors covering roughly 1 million DNFBP entities, a scale the FATF found hampered by a critical lack of resources and inconsistent risk-based prioritization.
FIM-GAP-003 (D2): Germany's TCSP (trust and company service …
FIM-GAP-003 (D2): Germany's TCSP (trust and company service provider) sector has no market-entry licensing checks, unlike more tightly controlled licensed financial sectors, per the FATF's 2022 Mutual Evaluation.
FIM-GAP-004 (D1): BaFin has been found insufficiently proact…
FIM-GAP-004 (D1): BaFin has been found insufficiently proactive in identifying unlicensed money-or-value-transfer-service (MVTS) providers, particularly hawala operators, leaving an informal-value-transfer channel with limited supervisory visibility.

Evidence

Confidence-tiered claims

Progressively consolidating AML supervision, sanctions enforcement and FIU functions under one federal roof, replacing the previously fragmented federal-state structure criticised by FATF [Source 1]
Probable · 1 source
AMLA operational in Frankfurt since 1 July 2025; AMLR (Regulation (EU) 2024/1624) applies directly from 10 July 2027 [Source 1]
Probable · 1 source
SARs must be filed exclusively via goAML without delay (same or next working day) as of March 2026, under the GwG Section 46(1) duty to stand still pending FIU clearance
Uncertain
Germany holds the largest population of MiCA crypto-asset service provider authorisations in the EEA as of September 2026 (reported figures diverge between ~53 and ~91), following a national transitional-period cutoff of 31 December 2025, earlier than MiCA's EU-wide 1 July 2026 outer limit [Source 1]
Probable · 1 source
Heightened AML supervisory scrutiny reported for crypto, fintech and payments institutions heading into 2026, including more on-site inspections [Source 1]
Probable · 1 source
BaFin set new deadlines on 15 Sep 2026 for remedying AML/CTF transaction-monitoring data-processing system shortcomings, following prior timeframes set in 2021 and 2023 [Source 1]
Probable · 1 source
BaFin ordered the firm to submit contracts with placement agents and other documents needed to fulfil customer due-diligence duties under the GwG [Source 1]
Probable · 1 source
From 1 October 2026 BaFin began publishing a tabular overview of EBA/AMLA ESA guideline adoption status instead of individual circulars [Source 1]
Probable · 1 source
BaFin refused the MiCA CASP licence application of Futurum Bank AG, operator of bitcoin.de; prior toleration of crypto-asset services ends; trading and deposits suspended since 12 June 2026 [Source 1]
Probable · 1 source
AMLA (headquartered in Frankfurt) targeted finalisation of its provisional list of entities eligible for direct supervision by end-September 2026, ahead of 2027 selection and 2028 commencement of direct supervision [Source 1]
Probable · 1 source
UniCredit formally applied for EU antitrust clearance of its proposed Commerzbank acquisition, announced 12 October 2026; UniCredit holds an economic interest of approximately 47.6% of Commerzbank's share capital [Source 1]
Probable · 1 source
BaFin ordered new deadlines (final 6 Oct 2026, announced 9 Oct 2026) for remedying deficiencies in AML/CTF transaction-monitoring data-processing systems, updating prior 2021 and 2023 orders. [Source 1]
Probable · 1 source
BaFin fined abcfinance GmbH €90,000 for GwG violations: several suspicious-activity reports filed late, relating to conduct in April 2025. [Source 1]
Probable · 1 source
BaFin refused futurum bank AG's MiCAR CASP authorisation application (filed 27 June 2025), disclosed 6 October 2026, ending its prior toleration (Duldung) to continue crypto-asset services. [Source 1]
Probable · 1 source
Bitcoin Group SE is finalising agreements with two separately-regulated German institutions (trading counterparty; custodian) to resume Bitcoin.de trading; no financial terms disclosed. [Source 1]
Probable · 1 source
FATF's own assessment calendar lists Germany's next possible onsite mutual-evaluation period as 2029-02-01; an older US State Department source stated a 2026 re-evaluation. The two sources disagree; FATF's own calendar is weighted as authoritative. [Source 1]
Disputed · 1 source
BaFin withdrew the banking licence and ordered wind-down on 22 October 2026 [Source 1]
Probable · 1 source
Two EUR 6,000 fines (EUR 12,000 total) for breach of WpHG notification duties, 21 October 2026 [Source 1]
Probable · 1 source
BaFin issued a public warning on 21 October 2026 for offering banking business without required authorisation [Source 1]
Probable · 1 source
Since July 2024, where several listed persons hold stakes in an entity, their holdings are aggregated to test the 50% ownership threshold; a separate control test can also catch sub-50% holdings; the presumption is rebuttable. [Source 1]
Uncertain · 1 source
A new general reporting duty (Jedermannspflicht) requires anyone becoming aware of frozen funds/economic resources of a sanctioned person to report without undue delay to the Bundesbank or BAFA; self-reporting exemption no longer generally available. [Source 1]
Probable · 1 source
Cross-border payments between residents and non-residents exceeding EUR 50,000 (raised from EUR 12,500, effective January 2025) must be reported to the Bundesbank by the 7th working day of the following month. [Source 1]
Probable · 1 source
A beneficial owner is any natural person holding more than 25% of capital/voting rights, or otherwise exercising comparable control; exactly 25% does not qualify; fictitious BOs (managing directors) registered if no natural person meets the threshold. [Source 1]
Probable · 1 source
The former notification fiction (commercial register entry satisfying Transparenzregister duty) has been abolished; companies must actively notify the register without undue delay. [Source 1]
Probable · 1 source
Enhanced due diligence applies where risk analysis indicates higher ML/TF risk, including PEPs (minimum 12 months post-office), high-risk third countries, and correspondent banking relationships, which must be reviewed/amended/terminated for high-risk-third-country respondents. [Source 1]
Probable · 1 source
Obliged entities may rely on third parties for CDD but retain responsibility; reliance on third parties in high-risk third countries is prohibited (subject to group exceptions); EDD under § 15 cannot be outsourced. [Source 1]
Probable · 1 source
Lawyers, notaries, patent attorneys (only when participating in catalogue transactions), auditors, tax advisers and company/trust service providers are GwG obliged entities. [Source 1]
Probable · 1 source
Since 1 January 2024, all lawyers who are GwG obliged entities must register with the FIU via goAML Web, regardless of whether a SAR has been filed. [Source 1]
Probable · 1 source
The LkSG employee threshold for in-scope companies was reduced from 3,000 to 1,000 employees in Germany, effective 1 January 2024. [Source 1]
Probable · 1 source
BaFin is Germany's competent authority for MiCAR supervision of CASPs and ART/EMT issuers; providing crypto-asset services without authorisation under Art. 59(1)(a) MiCAR is a criminal offence under KMAG § 46 Abs. 1 Nr. 3, punishable by up to 5 years imprisonment or a fine. [Source 1]
Probable · 1 source
PSPs must attach minimal payer/payee account data for transfers below EUR 1,000; full information is required at or above EUR 1,000, with full data to be provided to a requesting intermediary/payee PSP within 3 working days. [Source 1]
Probable · 1 source
CASPs must attach full originator/beneficiary data to every crypto-asset transfer regardless of value, with no de minimis; transfers above EUR 1,000 to/from a self-hosted address additionally require ownership verification measures. [Source 1]
Probable · 1 source
in_force [Source 1]
Probable · 1 source
in_force [Source 1]
Probable · 1 source
in_force [Source 1]
Probable · 1 source
in_force [Source 1]
Probable · 1 source
in_force [Source 1]
Probable · 1 source
in_force [Source 1]
Probable · 1 source
in_force [Source 1]
Probable · 1 source
in_force [Source 1]
Probable · 1 source
in_force [Source 1]
Probable · 1 source
in_force [Source 1]
Probable · 1 source
proposed increase pending; current caps EUR 10m (intentional) / EUR 5m (negligent) [Source 1]
Probable · 1 source