Risks from Inadequate Prevention of Money Laundering and Terrorist Financing
Unterföhring bei München, 18.02.2026 (PresseBox) -
Risks from Inadequate Prevention of Money Laundering and Terrorist Financing
source: BaFin - 6. Risiken aus unzureichender Prävention von Geldwäsche und Terrorismusfinanzierung →
Executive Summary
The German financial market remains under elevated pressure from money laundering (AML) and terrorist financing (CFT) risks. According to BaFin’s assessment for 2026, the risk landscape is becoming increasingly complex due to geopolitical tensions, the fragmentation of payment transactions, and the rapid expansion of the crypto-asset sector. Germany’s central geographic location and the size and heterogeneity of its financial market make it a primary target for abuse.
A critical takeaway for obliged entities is the necessity of distinguishing between AML and CFT measures. While AML is well-established, BaFin observes that CFT often lacks sufficient focus and requires "tailor-made measures" due to the legal origin of funds and typically lower transaction volumes. Furthermore, BaFin is signaling a "strict stance" against deficiencies, planning at least 75 special audits in 2026 with a focus on customer risk classification, the "Travel Rule" for crypto-assets, and high-risk country transactions, particularly involving Iran.
Regulatory and Legal Context
The supervisory guidance provided by BaFin is rooted in the Geldwäschegesetz (GwG - Money Laundering Act) and the Kreditwesengesetz (KWG - Banking Act). BaFin acts as the competent authority interpreting these statutes and announcing supervisory expectations for obliged entities.
Key legal and regulatory touchpoints identified include:
- The Travel Rule: Implementation of requirements for crypto-asset service providers, applicable since December 2024.
- Iran Sanctions: The re-entry into force of specific Iran sanctions in September 2025.
- FATF Assessments: The Financial Action Task Force's (FATF) designation of Iran as a high-risk country (confirmed October 2025).
- GwG Amendments: Ongoing adjustments to the Money Laundering Act, specifically regarding transactions with self-hosted addresses in the crypto sector.
Detailed Analysis of Supervisory Themes
1. Distinction Between Terrorist Financing and Money Laundering
BaFin identifies a common supervisory deficiency where obliged entities fail to sufficiently consider CFT risks, often treating them as an adjunct to AML.
- Source of Funds: In CFT, funds often originate from legal sources (salaries, donations) before entering criminal networks.
- Transaction Volume: CFT transactions are often small, meaning "measures for money laundering prevention, which are designed to detect larger, unusual transactions, do not work in the prevention of terrorist financing" (BaFin, 6. Risiken aus unzureichender Prävention von Geldwäsche und Terrorismusfinanzierung).
Complex structures are increasingly used to hide the economic background or the identity of beneficial owners. BaFin highlights a shift in trade flows to countries geographically close to sanctioned states ("Anrainerstaaten").
Method / Description
Phantom Trade Billing for goods that were never delivered.
Price Manipulation Over- or under-invoicing of goods to facilitate illegal asset transfers.
Unjustified Intermediaries Involving German companies or multiple actors between importers and exporters without a plausible reason to create "pass-through" transactions.
BaFin notes: "With the re-entry into force of the Iran sanctions in September 2025, the risk of circumvention transactions in transactions with an Iran connection has increased significantly" (BaFin, 6. Risiken aus unzureichender Prävention von Geldwäsche und Terrorismusfinanzierung).
3. Risks in the Crypto-Asset Sector
The anonymity and speed of crypto-transactions present a "double threat." Criminals use "unhosted wallets" to hide identities, and crypto-assets are frequently swapped rapidly to hinder law enforcement tracking. Furthermore, terrorist organizations are increasingly soliciting donations via digital currency.
4. Vulnerabilities of Payment Service Providers
The growth of online trade and card payments has heightened the relevance of security precautions for payment service providers. BaFin identifies "organizational weaknesses, e.g., in customer identification or the risk assessment of contractual partners" as a growing area of concern.
Supervisory Expectations and Practical Implications
Based on BaFin’s stated objectives and identified risks, obliged entities must align their operations with the following expectations:
Operational Compliance Requirements
- Enhanced Due Diligence (EDD): For new customer relationships, entities should implement "Adverse Media Screening" and verify the "planned use of funds for a transaction."
- Tailored CFT Controls: Development of specific internal audit criteria that account for the unique patterns of terrorist financing circumvention, rather than relying solely on AML thresholds.
- Monitoring System Updates: Internal security measures and monitoring systems must be adjusted to "current risk scenarios" to detect conspicuous transaction patterns early.
- Plausibility Checks: The actual economic or country-specific backgrounds of transactions and underlying payment flows must be scrutinized to avoid "intransparency."
BaFin has outlined a concrete roadmap for its 2026 supervisory cycle:
- Special Audits: At least 75 audits covering both the banking and non-banking sectors.
- Sector-Specific Focus (Banks): Audits will prioritize "customer risk classification" and the implementation of the "Travel Rule" for crypto-assets.
- Sector-Specific Focus (Non-Banks): Monitoring of business relationships and transactions.
- Agent Monitoring: Intensive focus on the 5,000+ registered agents for EU payment institutions in Germany, specifically those with high AML/CFT risk profiles.
- Guidance Publication: BaFin will release specific guidance for the "Sortengeschäft" (currency exchange/account-independent business).
The overarching message from BaFin is that the prevention of money laundering and terrorist financing requires constant evolution to match the increasing complexity of the financial system. The supervisor emphasizes that "prevention remains demanding because the risk situation is constantly changing."
Obliged entities are expected to proactively address the "high-risk country business" and the "Travel Rule" requirements. Failure to improve transaction monitoring and data analysis will likely result in strict supervisory measures, as BaFin intends to "continually work towards ensuring that obliged entities improve their transaction monitoring and data analysis" (BaFin, 6. Risiken aus unzureichender Prävention von Geldwäsche und Terrorismusfinanzierung).
