From 10 July 2027, Article 18 of the EU Anti-Money Laundering Regulation (AMLR) applies directly to your German branch. For AMLR outsourcing Germany, that means six tasks that you can never hand to a provider.
Notify first, keep the decisions, and plan for the report. You can still outsource anti-money laundering (AML) tasks after 10 July 2027, but six tasks, among them the suspicious activity report, stay with your firm. Arrangements made under § 6 (7) of the German Anti-Money Laundering Act (Geldwäschegesetz, GwG) need a review before that date.
01
Today
Under § 6 (7) GwG you notify the supervisor before a provider starts. The supervisor can prohibit the transfer on three grounds, and responsibility stays with you. § 45 (4) GwG points suspicious activity reports to the same route.
02
From July 2027
Article 18 (3) AMLR lists six tasks that cannot be outsourced under any circumstances, including the report to the Financial Intelligence Unit (FIU). The provider counts as part of your firm, and you stay fully liable.
03
Germany
Press reports of October 2026 describe a ministerial draft that would repeal the GwG and replace it with a new Act from 10 July 2027. We have not reviewed the draft text.
04
Next steps
Map every AML task that a provider or group function performs for your branch, re-paper the contracts and settle who files reports. Guidelines from the EU Anti-Money Laundering Authority (AMLA) are due by 10 July 2027.
AMLR outsourcing Germany involves more bodies than one supervisor. This overview helps if your head office is outside Germany and the German structures are new to you.
BaFin (the German Federal Financial Supervisory Authority, Bundesanstalt für Finanzdienstleistungsaufsicht) supervises, among others, credit institutions, financial services institutions, and payment and e-money institutions under § 50 no. 1 GwG. Your outsourcing notice goes to the supervisor competent for your firm.
Obliged entities outside the catalogue of § 50 nos. 1 to 8 GwG, for example in the non-financial sector, are supervised by the body competent under federal or state law (§ 50 no. 9 GwG).
The Financial Intelligence Unit (Zentralstelle für Finanztransaktionsuntersuchungen, FIU) receives suspicious activity reports. It is organised within German Customs.
The EU Anti-Money Laundering Authority (AMLA) has its seat in Frankfurt and started work on 1 July 2025. By 10 July 2027 it must issue guidelines on outsourcing under Article 18 (8) AMLR.
The Federal Ministry of Finance (Bundesministerium der Finanzen, BMF) prepares the German legislation. A ministerial draft (Referentenentwurf) is the stage before the cabinet decision and the debate in the Bundestag, the German parliament.
German anti-money laundering law regulates outsourcing today in § 6 (7) GwG. You may let a third party carry out your internal safeguards under a contract, but only if you have notified the supervisor beforehand. The supervisor can prohibit the transfer if the provider does not offer the assurance of proper performance, if your ability to steer is impaired, or if supervision is impaired. In your notice you must show that none of these grounds applies, and responsibility for the safeguards stays with you.
The Act speaks of obliged entities, meaning the firms that are covered by the AML rules (in German, Verpflichtete). Two neighbouring rules matter for them. § 45 (4) GwG says that an obliged entity can use third parties for the suspicious activity report under § 43 (1) GwG in line with § 6 (7). § 17 (5) GwG lets you transfer the customer due diligence measures under § 10 (1) nos. 1 to 4 GwG to other suitable persons and companies, and § 17 (9) GwG leaves the general outsourcing rules of § 25b of the German Banking Act (Kreditwesengesetz, KWG) untouched.
§ 6 (7) GwG itself contains no list of tasks that must stay in house. That is the main difference from Article 18 AMLR. BaFin publishes interpretation and application notes for the firms it supervises, and you should read them alongside the Act.
Article 18 AMLR keeps the idea of outsourcing with prior notice, but it adds structure. The provider is regarded as part of your firm when it performs the task, and you remain fully liable for acts and omissions connected with it (Article 18 (2)). For each outsourced task you must be able to show the supervisor that you understand the rationale and the approach, and that the activities mitigate your specific risks.
| Topic | Today under the GwG | From 10 July 2027 under the AMLR |
|---|---|---|
| Notice to the supervisor | Before the provider starts (§ 6 (7) sentence 1 GwG). | Before the provider starts (Article 18 (1)). |
| Tasks that must stay in house | § 6 (7) GwG contains no list. | Six tasks that cannot be outsourced under any circumstances (Article 18 (3)). |
| Suspicious activity reports | Third parties may be used in line with § 6 (7) (§ 45 (4) GwG). | Reporting to the FIU is reserved. The only exception is another obliged entity of the same group in the same Member State (Article 18 (3) (e)). |
| Liability | Responsibility for the safeguards stays with you (§ 6 (7) GwG). | The provider counts as part of your firm, and you remain fully liable for acts and omissions (Article 18 (2)). |
| Contract and provider chain | A contractual agreement is required (§ 6 (7) sentence 1 GwG). | Written agreement. The provider and any sub-provider apply your policies. You perform regular controls (Article 18 (4)). |
| Providers outside the EU | § 6 (7) GwG has no express rule. | Barred for providers in third countries identified under Chapter III, Section 2, unless group conditions are met (Article 18 (6)). |
Before outsourcing, you must assure yourself that the provider is sufficiently qualified. The provider and any sub-provider must apply your policies and procedures, the conditions go into a written agreement, and you perform regular controls, with the frequency set by how critical the task is (Article 18 (4)). Outsourcing must also not materially impair your supervisor’s ability to monitor and retrace your compliance (Article 18 (5)).
Article 18 (6) bars outsourcing to providers established in the third countries identified under Chapter III, Section 2 of the AMLR, unless the provider belongs to your group, the group applies rules that comply with the AMLR or with equivalent third-country rules, and the supervisor of the home Member State oversees implementation at group level. The article does not ban every provider outside the EU.
By 10 July 2027, AMLA must issue guidelines on setting up outsourcing relationships, on the roles and responsibilities of the firm and the provider, and on supervisory expectations for critical functions (Article 18 (8)). As far as we could verify on 30 October 2026, no draft has been published.
Article 18 (3) AMLR names six tasks that cannot be outsourced under any circumstances. The table shows what the wording of each letter reserves.
| Letter | Task | What the wording reserves | Reference |
|---|---|---|---|
| (a) | Proposal and approval of the business-wide risk assessment | Proposal and approval | Article 18 (3) (a), with Article 10 (2) |
| (b) | Approval of the internal policies, procedures and controls | Approval | Article 18 (3) (b), with Article 9 |
| (c) | Decision on the risk profile attributed to the customer | Decision | Article 18 (3) (c) |
| (d) | Decision to enter into a business relationship or to carry out an occasional transaction | Decision | Article 18 (3) (d) |
| (e) | Reporting of suspicious activity to the FIU, and threshold-based reports | The report itself | Article 18 (3) (e), with Articles 69, 74 and 80 |
| (f) | Approval of the criteria for detecting suspicious or unusual transactions and activities | Approval | Article 18 (3) (f) |
The letters are not uniform. Four of them, (b), (c), (d) and (f), reserve an approval or a decision. Letter (a) reserves the proposal as well as the approval, and letter (e) reserves the report itself. Whether preparatory work on a task can be bought in therefore depends on the letter, and AMLA’s guidelines may refine this.
Key point
Letter (e) has one exception: the task can be outsourced to another obliged entity of the same group that is established in the same Member State.
For a branch of a group headquartered in the UK or the US, this means that a group function abroad cannot take over the filing of German reports. This is our reading of the wording and is not yet confirmed by supervisory guidance.
Article 18 (7) adds a separate route for certain collective investment undertakings, which need the supervisor’s approval.
Chips in red mark steps that are still ahead.
Done. The AMLR enters into force.
Done. AMLA takes up its powers in Frankfurt.
Reported. Press reports describe a ministerial draft of a new German Act that would replace the GwG. The draft is under coordination between the ministries.
Open. A cabinet decision on the draft is reported as planned.
Open. The AMLR applies, including Article 18. AMLA’s outsourcing guidelines are due. The draft German Act is planned to enter into force on the same day.
Different people carry different parts of AMLR outsourcing Germany. The split below follows the functions that usually sit in a German branch or subsidiary.
Owns the decisions that Article 18 (3) reserves, notifies the supervisor before a provider starts, and must be able to show for each task that it understands the approach and that it mitigates your specific risks (Article 18 (2)).
Because the report stays with your firm, name the people in the German entity who file suspicious activity reports and who deputise. A group function abroad, for example the group Money Laundering Reporting Officer (MLRO), does not meet the narrow group exception.
Keeps the written agreement, the sub-provider chain and the controls in order, with a register that shows the notice date for each arrangement (Article 18 (4) and (5)).
Can support the German entity with analysis and drafts where the letters of Article 18 (3) allow it. Providers in identified third countries are barred unless the group conditions of Article 18 (6) are met.
Can test whether the controls over providers work in practice. The regular controls themselves are your duty under Article 18 (4).
You hand over the task, not the control. MaRisk AT 9, the outsourcing module of the Minimum Requirements for Risk Management (MaRisk), expects an institution to remain able to steer and monitor what it outsources.
These six points recur in set-ups where a group function or provider has grown into the German entity. They do not replace a review of your own arrangements.
Reports are filed from London or New York because the group has always done it. Article 18 (3) (e) reserves the report, and the group exception needs a group entity in the same Member State.
Article 18 (3) (e)
The provider starts work while the notice to the supervisor is still being drafted. Both § 6 (7) GwG and Article 18 (1) AMLR require notice before.
§ 6 (7) GwG, Article 18 (1)
The agreement binds the main provider only. Article 18 (4) extends your policies and procedures to every sub-outsourcing provider.
Article 18 (4)
Software or screening access is logged as outsourcing, or a provider that performs a requirement itself is logged as a tool. Recital 47 draws the line.
Recital 47
A service description lets the provider decide on onboarding or risk profiles. Letters (b), (c), (d) and (f) reserve these approvals and decisions.
Article 18 (3) (b), (c), (d), (f)
A group service centre outside the EU is used without checking the country. Article 18 (6) bars providers in identified third countries unless the group conditions are met.
Article 18 (6)
Select a status for each of the six questions. Nothing is stored or sent. The check is a self-assessment ahead of 10 July 2027 and does not replace legal advice.
These six steps work whichever way AMLA and the German legislator decide the open points. They build evidence that you will need anyway.
01
List every AML task that a provider or a group function performs for your German entity and assign it to the letters of Article 18 (3). Assign by the work actually done, not by the title of the contract.
02
Name the people in the German entity who file and deputise. If a group function files today, plan the transfer before 10 July 2027.
03
Cover the written agreement, sub-outsourcing, your policies, supervisor access and a review clause for AMLA’s guidelines (Article 18 (4), (5) and (8)).
04
Record the notice date for every arrangement and link it to contract signature. Ask your supervisor how notices under § 6 (7) GwG will carry over once the German Act is final.
05
Compare the location of each provider and sub-provider with the third-country lists under Article 18 (6).
06
One page per outsourced task: risk, measure, effect and control point, signed off by an owner in the German entity (Article 18 (2)).
Three key messages remain.
Both the GwG and the AMLR ask you to notify the supervisor before a provider starts. The AMLR adds structure around that notice.
Approvals, decisions and the suspicious activity report cannot be handed to a provider. That is a change for set-ups that rely on a group function abroad.
A ministerial draft is under coordination and AMLA’s guidelines are not yet published. Build evidence that holds under either reading.
AMLR outsourcing Germany is manageable if you map your arrangements task by task, keep the reserved decisions and filings in the German entity, and re-paper your contracts before 10 July 2027. What AMLA’s guidelines and the final German Act add will be known later, so build the evidence that holds under either reading.
Where this sits in the S+P service model. Compliance as a Service covers outsourced officer functions, including the Money Laundering Reporting Officer (MLRO) and Internal Audit, bundled in the S+P Compliance Package. 1st Line Services carry out operational work, such as financial crime and customer operations, under your instructions. RegTech tools such as the S+P Compliance Cockpit support both. Officer functions and operational services are delivered separately, in organisation and in staffing.
The answers reflect the position on 30 October 2026 and do not replace legal advice in an individual case.
Yes, with limits. Article 18 (1) AMLR allows outsourcing to service providers, but six tasks stay with your firm under Article 18 (3). You notify the supervisor before the provider starts, you conclude a written agreement, and you remain fully liable for the outsourced tasks (Article 18 (2) and (4)).
On our reading, no. Article 18 (3) (e) reserves the report to the FIU. The only exception is another obliged entity of the same group that is established in the same Member State, and a head office outside Germany does not meet that condition. AMLA’s guidelines may refine the point. Responsibility stays with your firm in any case.
Not today. § 6 (7) GwG requires notice before the transfer, and the supervisor can prohibit it on three grounds. Article 18 (1) AMLR also requires notice before the provider starts. A separate route applies to certain collective investment undertakings under Article 18 (7), where the supervisor must approve. For firms supervised by BaFin, the notice goes to BaFin.
Recital 47 says that the use or purchase of third-party software, or access to databases or screening services, is not considered outsourcing. A provider that performs a requirement itself is a different case and falls under Article 18. Borderline cases are a matter for AMLA’s guidelines.
Press reports in October 2026 describe a ministerial draft that would repeal the GwG and replace it with a new Act from 10 July 2027, with a cabinet decision planned before the end of 2026. We have not reviewed the draft text. Until the new rules apply, the current GwG remains the legal basis.
S+P Compliance prepares and runs the operational work: case handling up to the point where a report can be filed, monitoring, customer due diligence operations and documentation. Stays with you: the suspicious activity report to the FIU under § 43 GwG, decisions on a sanctions hold, the discrepancy report to the Transparency Register, the approval of scenarios and thresholds, and senior management approval under § 15 (4) no. 1 and (5) no. 2 GwG. You hand over the task, not the control.
Only official bodies are linked: EU institutions, the EU authority, BaFin and German federal law. The press reports on the German draft are not linked because they are not official sources.
Regulation (EU) 2024/1624 (AMLR). Authoritative text for Articles 9, 10 and 18 and for recital 47. Application from 10 July 2027 under Article 90. eur-lex.europa.eu
EUR-Lex summary of the AMLR. Confirms that the Regulation applies from 10 July 2027. eur-lex.europa.eu
European Parliament: Frankfurt to host AMLA. Source for the seat of the EU Anti-Money Laundering Authority. europarl.europa.eu
BaFin: interpretation and application notes. BaFin’s supervisory guidance for the obliged entities it supervises. bafin.de
§ 6 Geldwäschegesetz (German). Notice before outsourcing internal safeguards, grounds for prohibition and retained responsibility (§ 6 (7)). gesetze-im-internet.de
§ 45 Geldwäschegesetz (German). Use of third parties for the suspicious activity report (§ 45 (4)). gesetze-im-internet.de
§ 17 Geldwäschegesetz (German). Contractual outsourcing of customer due diligence (§ 17 (5) and (9)). gesetze-im-internet.de
§ 15 Geldwäschegesetz (German). Senior management approval in enhanced due diligence cases (§ 15 (4) and (5)). gesetze-im-internet.de
§ 50 Geldwäschegesetz (German). Competent supervisory authorities. gesetze-im-internet.de
Legal position on 30 October 2026. Regulation (EU) 2024/1624 applies from 10 July 2027 under its Article 90. Check all references against the current official text.
AMLR outsourcing touches several workstreams. These pages connect.
The service view for firms that look for an external Money Laundering Reporting Officer for their German entity. Control, decision authority and final responsibility stay with your firm, and reports to the FIU under § 43 GwG are not handed over.
Outsourced officer functions for institutions in Germany, bundled in one agreement.
Central outsourcing management: register, controls and provider oversight for the arrangements that Article 18 now structures.
External internal audit that can test whether your controls over providers work in practice.
KYC and due diligence operations carried out under your procedures.
The task-by-task analysis of the six reserved tasks and the approval levels, from our main site (English).
The German edition covers the same Regulation for institutions in Germany, with references to German law and the national implementation questions.
We use cookies and similar technologies to improve your experience on our website. Read our Privacy Policy.