Comprehensive Guide on Anti-Money Laundering and Know Your Customer Regulations in Germany (2025)
Germany Strengthens AML Regulations for Virtual Asset Service Providers
In an effort to combat money laundering and terrorist financing, the Federal Financial Supervisory Authority (BaFin) in Germany has updated its Anti-Money Laundering (AML) regulations for Virtual Asset Service Providers (VASPs).
Under the new regulations, VASPs are required to strictly comply with AML/KYC policies, customer due diligence (CDD), transaction monitoring, and periodic reporting obligations. This includes verifying the identity of both senders and receivers, screening transactions for risks related to money laundering and terrorist financing, and transmitting detailed originator and beneficiary information for virtual asset transfers to comply with the FATF Travel Rule as implemented in Germany.
VASPs must also obtain a specific license to operate legally, which entails submitting AML/KYC policies, corporate documentation, proof of capital, and demonstrating technical and professional competence. These regulations align with the EU AML directives and aim to mitigate risks such as illicit use of stablecoins, DeFi platforms, and other virtual asset-related threats.
BaFin's regulation requires VASPs to maintain enhanced due diligence processes, ensure transparency in transactions by sharing identifying data (Travel Rule compliance), implement risk-based AML controls, and be subject to ongoing supervision and periodic reporting to prevent illicit activities using virtual assets. This regulatory approach reflects Germany's adherence to the 5th and 6th EU Anti-Money Laundering Directives, updated FATF standards, and national AML laws, emphasizing licensing and operational compliance for all VASPs offering services like exchange, custody, token issuance, and wallet provision within Germany.
For complex or suspicious transactions, a thorough check is required, and enhanced ongoing monitoring must be set up. Reporting any suspicion of money laundering via a Suspicious Activity Report (SAR) is also required under the Geldwäschegesetz-GwG.
BaFin enforces several other acts and regulations, including the Banking Act, the Insurance Supervision Act, the Payment Services Supervision Act, the Investment Code, the Criminal Code, and the Securities Trading Act.
For businesses, these evolving AML requirements may seem complex, but a reliable and compliant KYC platform can make the process smooth and pleasant. Companies must not underestimate the importance of recording and storing data, as they often face external audits. The entire video identification process must be recorded and retained by the obliged entity for at least five years, but no longer than ten years.
BaFin also distinguishes between Simplified Due Diligence (SDD) and Enhanced Due Diligence (EDD) for CDD requirements. SDD is rarely conducted, while EDD is applied whenever a single high-risk factor is present. For Politically Exposed Persons (PEPs) or a close acquaintance of a beneficial owner of the client company, EDD must be applied.
Companies at risk of money laundering, such as financial institutions, real estate agents, and casinos, are obligated to verify customer identities, conduct risk assessments, and monitor transactions as part of Customer Due Diligence (CDD) under the GwG.
For more detailed information on BaFin's CDD requirements, businesses can refer to the official website. The Interpretation and Application Guidance (AuA) describes AML obligations under BaFin in relation to the GWG and other laws. The FATF Recommendations on AML/CFT may also be useful since Germany is a member of the Financial Action Task Force.
Penalties for non-compliance with the GwG, enforced by BaFin, can include heavy fines or criminal charges. For serious or systematic violations, a company can receive a fine of up to €5 million.
Since January 1, 2020, crypto assets have been considered financial instruments by BaFin, making crypto businesses subject to AML and KYC requirements. BaFin renewed its guidelines for updating customer information effective from February 1, 2025. Customer information must now be updated at least every seven years for SDD, at least every five years for general CDD, and annually for EDD.
These updates to BaFin's regulations come as part of Germany's broader effort to strengthen control over virtual assets and to protect the financial system from abuse. The regulations also aim to align with the EU's Markets in Crypto-Assets (MiCA) framework, under which BaFin supervises a vast range of sectors, including the regulation of virtual assets.
[1] BaFin. (2021). AML/KYC requirements for VASPs under the GwG. Retrieved from https://www.bafin.de/SharedDocs/Veroeffentlichungen/DE/Themenschwerpunkte/Geldwäsche/Geldwäschegesetz/virtual-asset-service-providers.html
[2] European Commission. (2020). EU AMLD5 and AMLD6. Retrieved from https://ec.europa.eu/info/publications/european-union-anti-money-laundering-directives_en
[3] Financial Action Task Force (FATF). (2019). FATF Standards. Retrieved from https://www.fatf-gafi.org/topics/virtual-assets-and-virtual-asset-service-providers/
[4] Financial Action Task Force (FATF). (2019). FATF Recommendations on AML/CFT. Retrieved from https://www.fatf-gafi.org/publications/fatfrecommendations/documents/fatf-recommendations.html
[5] European Commission. (2022). EU Markets in Crypto-Assets (MiCA) framework. Retrieved from https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12522-Regulation-on-Markets-in-Crypto-Assets-MiCA_en
- The adjustments in Germany's AML regulations for Virtual Asset Service Providers (VASPs) also have implications for the personal-finance, technology, and education-and-self-development sectors, as these industries may involve investments in virtual assets.
- As Germany strengthens its control over virtual assets, news outlets covering general-news and sports might also be interested in reporting on the implications of these regulations on gaming platforms that offer casino-and-gambling services, especially those incorporating virtual assets.
- The stricter AML regulations in Germany will likely impact businesses operating in various sectors, making compliance with KYC and AML policies essential for maintaining a robust business relationship within the country, as noted in the Banking Act, the Insurance Supervision Act, the Payment Services Supervision Act, the Investment Code, and the Securities Trading Act.
- The ongoing efforts to combat money laundering and terrorist financing through stricter AML regulations in Germany will ultimately contribute to a safer and more transparent business environment for sectors like finance, business, lifestyle, and sports.
- In addition to the regulations specific to virtual assets, companies operating in Germany are advised to familiarize themselves with the FATF Recommendations on AML/CFT, given that Germany is a member of the Financial Action Task Force and adheres to these standards.
){kind=link}