A (New) "To Do" List for Obliged Entities
On 29 November 2024, Germany's Federal Financial Services Supervisory Authority ("BaFin") and Financial Intelligence Unit ("FIU") released two important publications on obligations under AML law:
- an update to BaFin's Interpretation and Application Guidance on the German Anti-money Laundering Act (Auslegungs- und Anwendungshinweise zum Geldwäschegesetz – "AuA 2024")1 and
- new interpretative guidance jointly written by BaFin and the FIU on the concepts of "Unverzüglichkeit" (without undue delay) and "Vollständigkeit" (completeness) as they relate to suspicious activity reports ("Joint SAR Guidance" or "Guidance").2
All obliged entities subject to BaFin supervision must be compliant with the AuA 2024 as of 1 February 2025, meaning that these entities need to determine whether and how they are not in compliance with the AuA 2024 and implement the necessary adjustments in a rather short timeframe. The joint SAR Guidance is intended to supplement previous publications of the FIU and BaFin and has essentially taken effect immediately.
- the rules on the incompatibility of certain functions have been made more strict. Even before the AuA 2024, combining the roles of AML officer with that of data protection officer or internal auditor met with BaFin's opposition. The AuA 2024 specifies that the AML officer can generally neither assume the position of data protection officer or internal auditor nor must be the outsourcing officer overseeing the delegation of those other roles and
- AML officers' tasks now clearly include maintaining written documentation on the subject matter, purpose, those responsible and due dates for monitoring activities (e.g. in the form of a control plan).
Delegation / Outsourcing
The AuA 2024 underscores that obliged entities must pay particular attention that adequate resources are provided by multi-client service providers when the AML officer's tasks have been delegated to them.
Furthermore, BaFin takes the view that the performance of tasks by a non-German parent company or the head office (in the case of branches) or by another branch qualifies as outsourcing.
Obliged entities should therefore check whether their existing arrangements comply with the requirements applicable to outsourcing.
Customer due diligence obligations
Several additional changes in the AuA 2024 relate to customer due diligence ("CDD") obligations:
- BaFin has clarified that, depending on the overall circumstances of the individual case, a business relationship may be deemed established as early as the second transaction between two parties, thereby triggering CDD obligations. BaFin provides the following scenario as an example that may meet this threshold: a customer who repeatedly utilises a certain service of an obliged entity over a long period of time and where it is foreseeable that the service will also be utilised in the future. It remains the case that the mere initiation of a contractual relationship (Vertragsanbahnung) will not be qualified as a business relationship. This may be relevant for obliged entities in particular when it comes to their marketing activities;
- among the measures required for confirming the veracity of the identification documents provided by legal entities (including partnerships), the AuA 2024 specify that up-to-date extracts from the Commercial Register and other domestic or equivalent foreign official registers must be used which at the time of the initial processing by the obliged entity may not be older than three months; and
- the rules on the intervals at which client information must be updated have been amended; the maximum time allowed between updates has been shortened from ten to five years for clients to which neither simplified nor enhanced CDD applies and one year (instead of the previous two years) for customers subject to enhanced CDD. The 15-year cycle for customers subject to simplified CDD has been abandoned in favour of indeterminate "risk-appropriate" regularity. When determining the appropriate update cycle developments at national and EU level must be taken into account. It should be noted that Article 26 of the EU AML Regulation 2024/1624 which must be applied as of 10 July 2027 sets a maximum period of five years for all other customers than higher risk customers, for the latter also under the Regulation an annual update cycle applies.
Please refer to the AuA 2024 for the rest of the changes applicable to CDD obligations.
2. Joint SAR Guidance
The Joint SAR Guidance does not deal with SAR filing requirements as a whole, instead focussing exclusively on the requirement to file SARs "without undue delay" and "completely". This new Guidance is complementary both to the AuA 2024 and to earlier guidance provided by the FIU on the description of facts in SAR reports. It should also be noted that the FIU already released guidance on scenarios and situations not requiring an SAR in May 2023.
a. "Without undue delay"
In recent years, BaFin has conducted several administrative fine proceedings against financial institutions not only for omitted but also for late SAR filings. At the same time, financial institutions have criticised the lack of precise timelines from regulators on when to submit SARs.
Whoever expected in this long-expected Guidance an exact specification of the number of days between incident and submission of the SAR will be disappointed: the Guidance repeats many rather unspecific principles that have already been communicated in the past about submitting SARs in a timely fashion. In particular, BaFin and the FIU maintain the view that no general rules or specific timelines can be defined. Rather, the unique features of each individual case will be deemed decisive.
While the Guidance reaffirms that the threshold for an SAR filing requirement is below the initial suspicion (Anfangsverdacht) required for the initiation of an investigation under German criminal law, it also clarifies that there must be facts indicating reportable circumstances rather than mere assumptions or speculation. In this context, the Guidance expressly acknowledges that no SAR is required if a further clarification of the facts is necessary in order to determine whether or not the filing obligation has been triggered. At the same time, the Guidance emphasises that all facts and circumstances of the matter do not have to be thoroughly investigated (ausermittelt).
The Guidance puts somewhat new focus on the requirement that SARs be comprehensible (nachvollziehbar) and understandable on a stand-alone basis (aus sich heraus verständlich). As long as an obliged entity is not in a position to evaluate a complex matter in a way that such an SAR can be provided to the FIU, no SAR should or needs to be filed. The Guidance does make clear however that once facts have been identified that make a comprehensible and understandable SAR possible, the SAR must be filed with the FIU the same day or on the next business day at the latest (excluding Saturdays).
b. Completeness of SARs
The Guidance explains that SARs are considered complete if all facts (e.g. regarding persons, organisations, accounts and transactions) indicating circumstances requiring an SAR are reported.
For further explanation on how these facts are to be presented, the Guidance refers addressees to previous guidance provided by the FIU on the general requirements (for obliged entities in the financial sector) relating to this very subject.
Footnotes
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
