Germany as a financial centre has a medium-high risk of being abused for money laundering and terrorist financing, which corresponds to level 4 on a five-point scale from low to high. This was the conclusion of the first national risk assessment for the purposes of combating money laundering and terrorist financing (NRA, see info box below “What is the NRA?”), which was published on the website of the Federal Ministry of Finance (Bundesministerium der Finanzen – BMF) on 21 October 2019.

Key risk areas result from Germany’s high economic attractiveness, the cash-intensive nature of the country’s economic system and the international interconnectedness of its economy. In this article, BaFin presents six of these risk areas.

1. Anonymity

It goes without saying that those involved in money laundering and terrorist financing wish to remain anonymous. The assessment has shown that criminals prefer to use cash over other payment methods, since cash payments leave fewer traces. In the international movement of funds gained by criminal means, organised criminal groups also often resort to cash couriers.

Cash is not only popular among criminals; it is also favoured among law-abiding citizens. Coins and banknotes are the most commonly used means of payment in Germany. Nonetheless, accepting cash payments remains risky because the cash could have been obtained by criminal means. Cash transactions are often the subject of suspicious transaction reports and investigations.

Because criminals also use gold and other precious metals in their illegal dealings, such cash-like assets are also associated with an increased risk of money laundering and terrorist financing. This is also true of certain cryptocurrencies and prepaid cards below 100 euros, since customer identification is only required above this amount. Cryptocurrencies that offer users complete anonymity and that do not allow transactions to be traced, such as Monero and Zcash, are particularly susceptible.

Obliged entities under money laundering prevention laws must identify their business partners and must comply with the due diligence requirements. In order to provide further clarification as regards the verification of the source of funds in the case of cash transactions, BaFin is considering issuing detailed guidance to supplement the Interpretation and Application Guidance in relation to the German Money Laundering Act.

2. Fintech

The NRA has revealed that fintech companies (see info box “Fintech”) are not necessarily more susceptible to money laundering and terrorist financing than comparable companies from the same sector. Fintech companies subject to an authorisation requirement generally do not offer new products; they merely sell their products in an innovative way. However, caution must be exercised when, for example, an established market player cooperates with a fintech company that does not require authorisation. Innovative technologies that allow fast and anonymous payment processing could facilitate money laundering and terrorist financing.

When companies implement such new technologies, BaFin reviews whether these companies are in compliance with the requirements under anti-money laundering law. The findings BaFin obtains from on-site inspections, for example, are shared with other authorities, such as Germany’s Financial Intelligence Unit (FIU) and the prosecuting authorities.

3. Money-remittance business

There is a high risk that payments executed as part of money-remittance business, which is in principle legal under section 1 (1) sentence 2 no. 6 of the German Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz – ZAG), may be abused for the purposes of terrorist financing. The cash-intensive nature of this business makes it attractive to criminals. Cross-border cash transactions, financial transfers to high-risk countries and crisis regions, and payments outside of existing business relationships are particularly suspect. Payment service providers, in particular banks, must combat these risks with appropriate monitoring. Added to this are additional obligations; recently, BaFin has been paying increasing attention to compliance with these obligations.

The BMF estimates the extent of unrecorded financial transfer business conducted by companies without authorisation from BaFin to be substantial. Prohibited methods include hawala banking, which is a form of coded transfer system that works on the principle of trust between known parties. BaFin investigates the providers of such services, prohibits their unauthorised operations and winds up the unauthorised business activities.

4. Real estate sector

There is also a high risk of money laundering in the real estate sector. Share deals (see info box “Share deals”) and complex company structures in which letterbox companies in foreign countries play a central role conceal the identities of the people responsible as well as the origins of the money involved. Money laundering prevention is often also insufficient in the case of foreclosures.

Only six percent of suspicious transaction reports concerning the real estate sector came from estate agents, notaries and lawyers. The NRA therefore concludes that obliged entities in the non-financial sector should be more aware of this issue and should pay special attention to the risk of money laundering in their industry in future. At the same time, however, financial companies that are involved in such transactions must also be alert – even if they only serve an advisory role.

5. Cross-border threat

Certain cross-border business arrangements carry a high risk of damaging the integrity of the German financial market (cross-border threat). The 11 regions and states that present a high money laundering risk for Germany are Eastern Europe (particularly Russia), Turkey, China, Cyprus, Malta, the British Virgin Islands, the Cayman Islands, Bermuda, Guernsey, Jersey and the Isle of Man.

The specific money laundering risks for Germany differ considerably by country. Whilst money gained by criminal means originating from Eastern Europe is often invested in Germany, the flow of funds between Germany and Turkey often moves in the other direction: here remittances from Germany to Turkey are highly significant. The British Virgin Islands, the Cayman Islands, Bermuda, Guernsey, Malta, Jersey and the Isle of Man are financial centres that facilitate non-transparent financial transactions. This gives criminals the opportunity to conceal transactions. Malta is a centre for online gambling, which is associated with a very high number of transaction flows. These are very hard to track, and attributing transactions to individuals is even more difficult.

BaFin recommends that companies address cross-border risks as part of their risk management system and that they establish internal monitoring processes.

6. Major banks

The NRA has identified a high risk in large, internationally active banks. This risk is derived from their extensive business activities, the high transaction volume and the international interconnectedness of such institutions. In the case of small, regional institutions, particularly savings banks and cooperative banks (Sparkassen and Volksbanken), and in the case of institutions classified as other credit institutions (“Sonstige Kreditinstitute”), the risk is less pronounced.

The BMF identified a particular risk for large banks in the context of cash, financial transfer and correspondent banking transactions, in addition to innovative business models and new technologies offered by fintech companies. The risks of correspondent banking rise when the correspondent bank is domiciled in a third country.

Current accounts are particularly susceptible to money laundering and terrorist financing since they can be used to hold highly fungible and liquid assets. Transactions can be carried out at short notice and at any time, as can withdrawals and deposits. Smaller amounts are particularly hard to track and are therefore suited to terrorist financing.

A new team within BaFin will focus on the bank-specific results of the NRA; this is intended as a kind of “intensive care unit” for high-risk banks.

What does BaFin expect from obliged entities?

The NRA is intended to increase awareness of risks in Germany in the fight against money laundering and terrorist financing. When preparing their company-specific risk analyses in accordance with section 5 (1) sentence 2 of the Money Laundering Act, obliged entities must take into consideration the country-, product-, and sector-specific risks identified in the NRA.

In practice, obliged entities must take suitable internal safeguards in order to mitigate their risks. Monitoring must reflect the extent to which the company has already reduced a risk.

Supervised entities should also use the NRA to set priorities and to allocate resources according to risk. BaFin will review whether companies have drawn the necessary conclusions from the NRA and whether they have taken all the necessary steps.

Under section 51 (8) of the GwG, BaFin is required to regularly update the interpretation and application guidance on implementing the due diligence requirements and the internal safeguards. BaFin will take into account numerous suggestions from expert discussions with representatives from the private sector.