The Laundromat – September 2026

Welcome to the September issue of The Laundromat newsletter, in which we take a look at the implications of the upcoming Customs and Financial Justice Act – and, of course, have once again compiled an overview of the latest money laundering news.

Topic of the Month: How Will the Customs and Financial Justice Act Affect Obliged Entities?

For institutions subject to the German Money Laundering Act (GwG) – and thus, in the future, to the European Anti-Money Laundering Regulation (AMLR) – the German „Zollfinanzgerechtigkeitsgesetz“ (ZFG), namely the Customs and Financial Justice Act, as currently drafted, will primarily entail additional operational obligations, expanded data and transparency requirements, and a greater burden of auditing and documentation. Credit and financial services institutions will be primarily affected. In some cases, financial holding companies will be subject to direct obligations for the first time. The draft is not final: the federal government has set January 1, 2027, as the planned effective date.

1. Active Support for Undercover Investigations

The proposed Section 25n of the German Banking Act (Kreditwesengesetz, KWG) would require financial institutions, upon order of law enforcement authorities, to open and maintain accounts under cover identities, to forward or block payments made under these identities, and to support undercover investigations and witness protection. This would expand the role of financial institutions beyond their current responsibilities of responding to requests for information or maintaining existing accounts. They would be actively involved in operational investigative measures.

The draft does not yet conclusively address key related issues: the treatment of such accounts in the account retrieval database, the application of the “account truth” principle under Section 154 of the Fiscal Code of Germany (Abgabenordnung, AO), deposit insurance, liquidity ratios, and potential liability and criminal liability risks.

Regardless of this, institutions need an onboarding and master data architecture that allows them to flag individual cases, remove them from standard processes, and log them comprehensively without disrupting the regular identification and monitoring chains. If they maintain their identification results in an audit-proof and machine-readable format, they can also document special cases instead of manually bypassing them.

2. Changes to the System for Reporting Suspected Cases

Section 43 of the Money Laundering Act (GwG) is to refer in the future to an “unlawful act within the meaning of Section 261 of the Criminal Code (StGB)” instead of a “criminal offense.” The draft describes this as an editorial clarification. However, the Association of International Banks views it as a potential substantive expansion of the reporting obligation. For financial institutions, this means additional uncertainty regarding interpretation and implementation, at least until the AMLR becomes applicable.

The timeline is important: The AMLR will take effect directly as of July 10, 2027. According to the aforementioned statement, Article 69 of the AMLR will then comprehensively and conclusively regulate the suspicious activity reporting system throughout the EU – Section 43 of the GwG will be superseded in this respect.

Regardless of how broad the reporting threshold becomes in the future, what matters in practice are the underlying data fields. Institutions that maintain structured and interoperable identification and KYC data can transition their reporting processes to the FIU without having to rebuild their data collection systems from scratch.

3. Financial Holding Companies

Financial holding companies and mixed financial holding companies are to be more comprehensively included in the scope of entities subject to these requirements and, in some cases, directly supervised, which may give rise to the following obligations:

• Conducting and updating a risk analysis
• Establishing internal safeguards
• Complying with customer due diligence obligations
• Appointing and integrating anti-money laundering officers
• Documentation and record retention
• Registration with the competent supervisory authority
• Preparing for anti-money laundering audits

This would expand the current scope of application; the previous limitation to certain financial holding companies would be eliminated. Violations of the proposed registration requirement would be subject to fines.

The holding company level would then no longer be covered only partially (via Section 25l of the KWG) or indirectly through subsidiary institutions. Groups should review whether identification and due diligence processes are uniformly established across the group or vary by entity. Uniform procedures and a shared set of supporting documentation reduce the administrative burden if multiple entities become subject to audits simultaneously.

4. Transparency Register and KYC Data

The draft also provides for strengthening the Transparency Register. In particular, it mentions expanded audit and oversight powers for the registry administrator, access to account transaction data, stricter requirements for reporting discrepancies, and the collection of additional data, such as the place of birth of beneficial owners.

For institutions subject to the GwG and the AMLR, this increases the importance of maintaining a consistent database for beneficial owners, ownership structures, customer master data, and ongoing monitoring processes. If personal data on beneficial owners is imported from verified sources – such as official identification documents or, in the future, the EUDI Wallet – rather than being entered manually, the number of discrepancies is reduced before they arise. Additional fields, such as place of birth, are then a matter of configuration rather than retroactive data collection.

5. Audit and Governance Efforts

The amendments to the Audit Report Regulation (Prüfungsberichtsverordnung, PrüfbV) explicitly include financial holding companies and mixed financial holding companies within the supervisory audit framework. Among other things, the audit examines compliance with anti-money laundering obligations and the requirements of the KWG. The workload arises primarily in cases where documentation must be reconstructed retroactively. Automatically generated, complete audit trails for each identification process shift this workload from audit preparation to day-to-day operations.

You can read more about the proposed law here:

• https://www.tagesschau.de/inland/innenpolitik/zoll-befugnisse-gesetz-100.html
• https://www.bundesfinanzministerium.de/Content/DE/Gesetzestexte/Gesetze_Gesetzesvorhaben/Abteilungen/Abteilung_III/21_Legislaturperiode/2026-03-03-Zollfinanzgerechtigkeitsgesetz/0-Gesetz.html

In Case You Missed It: Your AML News Overview

Mandatory Registration on the “goAML” Reporting Portal

All entities subject to the GwG have been required to register with the Financial Intelligence Unit’s digital reporting portal “goAML” since January 1, 2024 – regardless of whether they file a suspicious activity report (Section 45(1), second sentence, GwG). The German government now plans to treat failure to register as an administrative offense and impose fines.

FATF Report Highlights the Threat Posed by Hawala Banking

A new FATF report examines the growing role of underground banks, Hawala, and other similar service providers (HOSSPs) in facilitating illicit financing. The report highlights the vulnerability of these systems to money laundering and terrorist financing. In some cases, more than 500 million euros were laundered through underground banking and Hawala-based systems in just a few months. You can access the full report here.

Sanctions Against Russia and Belarus: Complex Requirements

In light of the sanctions against Russia and Belarus, companies and financial institutions must comply with complex legal requirements and align their internal control processes accordingly. Under the new provisions of the AMLR, the prevention of sanctions evasion and the enforcement of targeted financial sanctions are being more closely integrated into AML/TF regulations. This results in additional requirements for screening, monitoring, and governance for compliance, legal, and anti-money laundering functions.

German Municipalities Are Waiting for an Implementation Plan for the EUDI Wallet

Municipalities in Germany still lack a clear, nationwide implementation plan for the requirement to accept the German EUDI wallet “d-you,” which takes effect on January 2, 2027. Local government representatives are therefore calling for a binding roadmap by 2027 that includes a timeline, defined responsibilities, and centrally provided solutions for all approximately 11,000 municipalities. Key technical issues remain unresolved, as does the need for an awareness campaign targeting citizens and government employees.

Further Reading

The EU AMLR is coming – but what about the AMLA’s RTS and ITS requirements?

The European Anti-Money Laundering Authority (AMLA) publishes new Regulatory Technical Standards (RTS), Implementing Technical Standards (ITS), and Guidelines (GL) at regular intervals. Each of these can have a direct impact on your compliance processes. The WebID Regulatory Tracker provides a concise, reliable, and continuously updated overview of the status of implementation of the relevant legal acts.