## _cr16190 — EXECUTIVE SUMMARY

## Source details

**Canonical URL:** [_cr16190 — EXECUTIVE SUMMARY](https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2016/_cr16190.pdf)

## Other formats

- [Markdown version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2016/_cr16190.pdf.md)
- [Structured JSON version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2016/_cr16190.pdf.json)

---

### INTRODUCTION
- Purpose: Targeted review of selected areas of Germany’s anti-money laundering and combating the financing of terrorism (AML/CFT) regime in the context of the Financial Sector Assessment Program (FSAP).
- Scope: Focus on the money laundering (ML) offense (including self-laundering and predicate offenses), transparency of legal persons, and implementation of AML/CFT measures by banks with cross-border operations.
- Not an assessment: This note is not an evaluation of Germany’s overall AML/CFT compliance with the Financial Action Task Force (FATF) 2012 40 Recommendations and does not produce ratings.
- Future evaluation: Germany is expected to undergo a mutual evaluation (ME) by the FATF in 2021.
- Background indicators and context:
  - MER (2009/2010) estimated crime in Germany generated EUR 40 to EUR 60 billion (approximately $60–80 billion) per year (inclusive of tax evasion).
  - Alternative dollar conversion reported: $45.57–68.36 billion as at April 4, 2016.
  - Banking sector: total assets of about EUR 7.85 trillion at the end of 2014.
  - Germany has the highest number of credit institutions and foreign branches in the European Union and hosts the Frankfurt Stock Exchange.

### PROGRESS SINCE THE LAST ASSESSMENT
- Legislative and institutional reforms since the 2010 MER:
  - Amendments to the Criminal Code (Strafgesetzbuch), the Anti-Money Laundering Act (Geldwäschegesetz), the Banking Act (Kreditwesengesetz), and the Administrative Offenses Law.
  - Formation of domestic coordination mechanisms including the Forum for the Prevention of Money Laundering and Terrorist Financing chaired by the Federal Ministry of Finance.
  - Implementation actions under Germany’s National Action Plan (post-2013 G8 Lough Erne) committed to strengthening BO information and undertaking an NRA.
- Key specific measures:
  - Bearer shares: Amendments to the Stock Corporation Act (Aktiengesetz) effective December 31, 2015, restrict issuance of bearer shares and treat non-complying bearer shares as nominative registered shares; AGs issuing registered shares must keep a shareholders’ register.
  - National Risk Assessment (NRA): Germany is conducting a national ML and TF risk assessment in implementation of the 2012 FATF standard.
  - Oversight of DNFBPs: Increased supervisory staff and Länder have increased sanctions over supervised entities.
- Remaining vulnerabilities and observations:
  - MER identified deficiencies in ML and TF criminalization, freezing of terrorist assets, STR requirements, some CDD measures, sanctions for non-compliance, and BO information availability.
  - In 2012 and 2013, 39 percent of suspicious cases transferred by the FIU to specialized investigative agencies could not be linked to a specific predicate offense.
  - ML typologies remain difficult to determine; NRA expected to improve risk understanding.

### MONEY LAUNDERING OFFENSE
- Self-laundering:
  - Germany criminalized self-laundering in 2015.
  - The ML offense appears to cover conversion, transfer, concealment, disguise and acquisition of property with knowledge that they are proceeds of crime.
  - The offense does not cover possession and some aspects of the use of proceeds of crime; under the international standard these elements may be excluded if fundamental principles of domestic law prevent criminalization.
  - November 26, 2015 amendments (modification to Section 261 (9) CC) make self-laundering punishable under certain circumstances, excluding exemption when the perpetrator “brings an object... into circulation and, in doing so, conceals the unlawful origin of the object.”
  - Authorities interpret “bringing into circulation” to include acts where (i) the perpetrator relinquishes control of the object; (ii) a third person obtains control; and (iii) the perpetrator conceals the unlawful origin.
  - Examples of punishable conduct: depositing proceeds into an account in the perpetrator’s name; placing proceeds into a family member’s account; using proceeds to buy groceries or a car.
  - Possession and some “use” remain excluded where criminalization would contravene fundamental constitutional principles: rule of law (“Rechtsstaatsprinzip” Article 20, paragraph 3) and “ne bis in idem” (Article 103 paragraph 3).
  - A commissioned legal opinion by University Professor Dr. Christian Schroder concluded narrow non-punishability where a third party is not involved, a view partly contradictory with enacted provisions.
- Predicate offenses:
  - Germany expanded predicate offenses to include insider trading, market manipulation, counterfeiting, and piracy of products (amendments to CC in 2011).
  - Tax crimes have been predicate offenses since 2001; refined in 2007. Specific tax-related predicates: Section 373 Fiscal Code; Section 370 Fiscal Code; Sec. 374 para 2 Fiscal Code.
  - Predicate status for many tax crimes and some misdemeanors is contingent on aggravating criteria:
    - Committed “on a commercial basis” or by a “member of a gang.”
    - “On a commercial basis” defined as intent to commit repeated offenses to procure an ongoing source of income of some magnitude and for some duration; court rulings indicate the first tax crime motivated by pursuit of profit can suffice.
    - Amounts generated are irrelevant for the “commercial basis” test; tax evasion by gang or on commercial basis is predicate irrespective of amount.
    - A “gang” requires at least three people per Federal Court of Justice rulings.
  - Gap: Tax crimes and misdemeanors committed by an individual that generate significant amounts of proceeds may not be captured as predicates absent aggravating circumstances.
- Conclusions and recommendations (high-level):
  - Criminalization of self-laundering strengthens the ML offense; interpretation of “bringing into circulation” would benefit from clear court rulings.
  - Further minor improvements needed to predicate offense coverage, particularly to capture single events of tax offenses by individuals that generate significant proceeds.
  - Options: remove aggravating requirement (commercial basis or gang) or include reference to significant amounts of proceeds or a specific Euro threshold in tax crimes and misdemeanors.

### TRANSPARENCY OF LEGAL PERSONS
- Current framework and mechanisms:
  - Competent authorities have direct access to BO information collected by banks via a data retrieval system established pursuant to section 24C of the Banking Act; the system is populated by credit institutions.
  - Three ways to obtain BO information: (i) accessing information collected by reporting entities (data retrieval system for banks), (ii) requesting information from the legal person itself on the basis of court orders, and (iii) consulting company registers.
  - Data retrieval system contents: account number, opening and closing dates, account holders and authorized person’s names and birthdates and the beneficial owner’s name and (if known) address.
  - Data retrieval system provides real time access (information provided within two or three hours) and can be accessed without alerting relevant banks or customers; information cannot be used as evidence but can be used to gather further evidence.
- Limits and gaps:
  - Competent authorities do not have similar access to BO information collected by non-banks and DNFBPs; AML Act obliges such entities to obtain and keep BO records but those records are not part of the central data retrieval system.
  - Access to banks’ data retrieval system, while useful, is insufficient to ensure adequate transparency in all cases.
  - Company registers do not necessarily include BO information in all instances; legal persons are not specifically required to collect BO information.
  - Cross-border/multi-tier structures: tracing ultimate BOs is possible when shareholder entities are registered in company registers; where registered abroad and not in the data retrieval system, BO information must be obtained via international cooperation.
- Recent improvements:
  - Immobilization of bearer shares under AktG amendments effective December 31, 2015, and shareholders’ register requirement for AGs issuing registered shares.
  - Germany is working on AML Act amendments to establish a new transparency register implementing the 4th EU AML/CFT Directive; amendments due to be completed by June 26, 2017.
- Use statistics for the data retrieval system (number of accesses):
  - BKA - FIU: 2013 = 887, 2014 = 1,196, 2015 = 1,356
  - Federal Police (Bundespolizei): 2013 = 1,224, 2014 = 1,357, 2015 = 1,348
  - Other police agencies: 2013 = 73,185, 2014 = 86,989, 2015 = 73,185
  - BaFin: 2013 = 1,218, 2014 = 353, 2015 = 1,183
  - Tax authorities: 2013 = 13,397, 2014 = 13,401, 2015 = 13,003
  - Customs authorities: 2013 = 7,052, 2014 = 6,672, 2015 = 6,915
  - Public prosecutors: 2013 = 25,434, 2014 = 25,304, 2015 = 25,851
- Recommendations:
  - Require legal persons to collect and maintain accurate and up-to-date information on their beneficial owner(s).
  - Ensure timely access to beneficial ownership information held by legal persons.
  - Finalize implementation of the 4th EU AML/CFT Directive requirement regarding a registry of beneficial owners.
  - Enhance mechanisms to include BO information from reporting entities other than credit institutions.

### AML/CFT SUPERVISORY FRAMEWORK OVER BANKS (CROSS-BORDER OPERATIONS)
- Institutional architecture:
  - Single Supervisory Mechanism (SSM) comprising the ECB and national competent authorities entered on November 4, 2014; ECB directly supervises significant institutions (21 banking groups in Germany).
  - BaFin is the sole designated supervisory authority for AML/CFT for the financial sector of Germany and conducts AML/CFT supervision through its Department for the Prevention of Money Laundering (DPML); the Bundesbank has no ongoing AML/CFT supervision role.
  - AML/CFT supervision in member states does not fall under the SSM; the ECB is not an AML/CFT supervisor.
  - BaFin is the lead prudential supervisor for about 1,974 credit institutions including branches and subsidiaries of foreign banks operating in Germany.
- Role of external auditors:
  - BaFin relies mainly on external auditors to assess banks’ compliance with AML/CFT requirements; Audit Report Regulation defines auditors’ scope.
  - Section 29 (2) Banking Act requires auditors to conduct annual audits with respect to compliance with the AML Act and relevant sections of the Banking Act.
  - Auditors’ Annex 5 obligations include review of internal policies, AML officer functions, staff awareness, CDD compliance, recordkeeping, internal suspicious case reporting, outsourced CDD, group-wide AML/CFT controls (section 25l), wire transfers, correspondent banking, and account data retrieval compliance.
  - Auditors can visit overseas branches and subsidiaries but there is no specific requirement to do so; external auditors often work jointly with local audit offices.
  - BaFin does not have access to external auditors’ working papers other than those related to special audits commissioned by BaFin.
- BaFin’s risk-based approach and supervisory tiers:
  - BaFin analyzes and rates institutions (low, average or high) against five inherent risk criteria: geographic location, scope of business, products structure, customer structure, distribution structure.
  - Final net risk classification ranges from 1A (low risk-high quality of controls) to 3D (high risk–low quality of controls); large significant banks are classified as high for ML/TF risk.
  - Supervisory strategy tiers: (a) Simplified basic supervision for low net risk entities; (b) Basic supervision for medium net risk entities; (c) Enhanced supervision for high net risk and significant entities.
- Implementation and enforcement concerns:
  - Some German banks with cross-border operations have been subject to significant sanctions by foreign regulators for AML/CFT and sanctions violations with respect to overseas operations.
  - Need to enhance implementation of the Audit Report Regulation and ensure auditors pay special attention to banks’ risk assessments and control measures, including correspondent banking risks.
  - BaFin’s continued reliance on audit reports and banks’ internal assessments requires stronger enforcement of administrative obligations to account for group-wide cross-border risks.
  - BaFin’s AML/CFT supervisory staff is currently insufficient; entities per supervisor decreased from 200 in 2009 to about 124 in 2016.
  - BaFin’s DPML has a total of 110 staff, of which 40 engage in the data retrieval system and only 13 staff are directly involved in ongoing AML/CFT supervision of credit institutions.
  - GW 2 supervisors: on average one supervisor responsible for up to 124 banks, dedicating about 2-3 working days annually for each bank.
- Supervisory activity and evidence:
  - Number of targeted onsite visits in 2015: 33 in banks, 5 in branches of foreign banks, and 20–25 audit accompaniments.
  - AML/CFT reviews 2012–2014: 88, 26, and 28, respectively.
  - AML/CFT reviews of branches of foreign banks 2012–2014: 11, 64, and 8, respectively.
  - Targeted examinations on the account data retrieval system: 2011: 8; 2012: 10; 2013: 10; 2014: 1; 2015: 10.
  - BaFin conducted only three on-site AML/CFT inspections in 2014/2015 of foreign branches and subsidiaries of German banks.
- Identified supervisory and corporate governance deficiencies:
  - Need for enhanced group-wide risk management policies and controls at the parent level to identify, assess and mitigate ML/TF and related risks in overseas operations.
  - Improvements warranted in banks’ compliance and corporate governance frameworks, consolidated risk assessment and internal audit functions.
  - Need to enhance supervisory synergies between the ECB’s prudential supervision and BaFin’s AML/CFT supervision of significant banks, including joint onsite inspections and streamlined information exchange between ECB, BaFin and Bundesbank.
  - Strengthen collaboration between BaFin and the FIU concerning the quantity and quality of suspicious transaction reports (STRs).
  - Consider BaFin’s review of auditors’ working papers when warranted and increase BaFin DPML staff.

### INFORMATION SHARING AND CROSS-BORDER COOPERATION
- BaFin, Bundesbank and other competent EEA authorities can share banking information including group legal and organizational structure, management, adverse developments, and enforcement measures taken under the Banking Act; sharing can include AML/CFT issues though no specific formal arrangements ensure consistent implementation.
- BaFin is proposing an MOU with the ECB covering AML/CFT matters.
- BaFin and Bundesbank have entered into about 96 MOUs with foreign supervising authorities outside the EEA allowing cooperation on financial crimes including ML/TF.
- Prudential colleges of supervisors are established for institutions with cross-border operations; colleges are not specifically mandated to address AML/CFT issues and no AML/CFT colleges have been set up to date.
- Host supervisors can receive AML/CFT audit reports and supervisor-to-supervisor cooperation can include AML/CFT matters.

### STRS, FIU RELATIONSHIP, AND INFORMATION FLOWS
- Information obtained by BaFin on STRs is limited; BaFin gets general information from audit reports and from the FIU and/or the Police.
- Historically BaFin received STR information from some banks routinely but in 2016 BaFin informed banks to only report STR information to it if it related to significant or very serious suspected wrongdoing.
- STRs are an important source to assess implementation of AML/CFT policies; relationship between the FIU and BaFin should be strengthened through more frequent and formalized contact and sharing of information on the quantity and quality of STRs.
- BaFin meets with at least one regional police force once a year or more to discuss STR and typologies issues; meetings with other LEAs are ad hoc.

### MAIN RECOMMENDATIONS (summary)
- Ensure the ongoing national assessment of ML and TF risks adequately addresses risks from cross-border banking operations.
  - Priority: High
- Increase effectiveness of AML/CFT supervisory framework over cross-border banks by:
  - Ensuring auditors’ reports adequately assess banks’ group-wide risk management policies and controls.
  - Ensuring auditors’ reports comprehensively assess compliance with AML/CFT requirements listed in Annex 6 of the Audit Report Regulation.
  - BaFin review, when warranted, of auditors’ working papers regarding risk assessment and mitigation.
  - More active BaFin AML/CFT supervision to complement external auditors’ reviews and increasing DPML staff.
  - BaFin leveraging the ECB’s onsite supervision plans for AML/CFT work.
  - Enhancing information exchange between ECB, BaFin and Bundesbank.
  - Strengthening collaboration between BaFin and the FIU on quantity and quality of STRs.
  - Priority: High
- Enhance transparency of legal persons incorporated in Germany by:
  - Requiring legal persons to collect and maintain accurate and up-to-date information on their beneficial owner(s).
  - Ensuring timely access to such information held by legal persons.
  - Finalizing implementation of the 4th EU AML/CFT Directive requirement regarding a registry of beneficial owners.
  - Priority: Medium
- Ensure predicate offenses for ML include a broader range of serious offenses (including single events of tax offenses committed by individuals that generate significant amounts of proceeds).
  - Priority: Medium

*Source: EXECUTIVE SUMMARY and related sections, _cr16190 (INTERNATIONAL MONETARY FUND)*

### EXECUTIVE SUMMARY ____________________________________________________________________________ 4

### EXECUTIVE SUMMARY

### INTRODUCTION
- Purpose: Targeted review of selected areas of Germany’s anti-money laundering and combating the financing of terrorism (AML/CFT) regime in the context of the Financial Sector Assessment Program (FSAP).  
- Scope: Focus on the money laundering (ML) offense (including self-laundering and predicate offenses), transparency of legal persons, and implementation of AML/CFT measures by banks with cross-border operations.  
- Not an assessment: This note is not an evaluation of Germany’s overall AML/CFT compliance with the Financial Action Task Force (FATF) 2012 40 Recommendations and does not produce ratings.  
- Future evaluation: Germany is expected to undergo a mutual evaluation (ME) by the FATF in 2021.  
- Background indicators and context:
  - MER (2009/2010) estimated crime in Germany generated EUR 40 to EUR 60 billion (approximately $60–80 billion) per year (inclusive of tax evasion).
  - Alternative dollar conversion reported: $45.57–68.36 billion as at April 4, 2016.
  - Banking sector: total assets of about EUR 7.85 trillion at the end of 2014.
  - Germany has the highest number of credit institutions and foreign branches in the European Union and hosts the Frankfurt Stock Exchange.

### PROGRESS SINCE THE LAST ASSESSMENT
- Legislative and institutional reforms since the 2010 MER:
  - Amendments to the Criminal Code (Strafgesetzbuch), the Anti-Money Laundering Act (Geldwäschegesetz), the Banking Act (Kreditwesengesetz), and the Administrative Offenses Law.
  - Formation of domestic coordination mechanisms including the Forum for the Prevention of Money Laundering and Terrorist Financing chaired by the Federal Ministry of Finance.
  - Implementation actions under Germany’s National Action Plan (post-2013 G8 Lough Erne) committed to strengthening BO information and undertaking an NRA.
- Key specific measures:
  - Bearer shares: Amendments to the Stock Corporation Act (Aktiengesetz) that entered into force on December 31, 2015, provide that bearer shares can only be issued if shares are publicly listed or are immobilized; non-complying bearer shares are treated as nominative registered shares; AGs issuing registered shares must keep a shareholders’ register.
  - National Risk Assessment (NRA): Germany is conducting a national ML and TF risk assessment in implementation of the 2012 FATF standard.
  - Oversight of DNFBPs: Increased supervisory staff and Länder have increased sanctions over supervised entities.
- Remaining vulnerabilities and observations:
  - MER identified deficiencies in ML and TF criminalization, freezing of terrorist assets, STR requirements, some CDD measures, sanctions for non-compliance, and BO information availability.
  - In 2012 and 2013, 39 percent of suspicious cases transferred by the FIU to specialized investigative agencies could not be linked to a specific predicate offense.
  - ML typologies remain difficult to determine; NRA expected to improve risk understanding.

### MONEY LAUNDERING OFFENSE
- Self-laundering:
  - Germany criminalized self-laundering in 2015.
  - The ML offense appears to cover conversion, transfer, concealment, disguise and acquisition of property with knowledge that they are proceeds of crime.
  - The offense does not cover possession and some aspects of the use of proceeds of crime; under the international standard these elements may be excluded if fundamental principles of domestic law prevent criminalization.
- Predicate offenses:
  - Germany expanded the list of predicate offenses to include insider trading, market manipulation, counterfeiting, and piracy of products.
  - Tax crimes and some misdemeanors are predicate offenses to ML when undertaken on a commercial basis or by a member of a gang (as defined in the text).
  - Gap: Tax crimes and misdemeanors committed by an individual that generate significant amounts of proceeds are not captured.
- Conclusions and recommendations (high-level):
  - Further minor improvements needed to predicate offense coverage, particularly to capture single events of tax offenses by individuals that generate significant proceeds.

### TRANSPARENCY OF LEGAL PERSONS
- Current framework:
  - Measures taken to ensure transparency of German legal persons in business relationships with banks: competent authorities have direct access to BO information collected by banks via a data retrieval system populated by banks.
  - The FATF Recommendations cover legal persons and legal arrangements; this note covers only legal persons.
- Gaps and limitations:
  - Competent authorities do not have similar access to BO information collected by non-banks and DNFBPs.
  - Access to the banks’ data retrieval system, while useful, is insufficient to ensure adequate transparency in all cases.
- Recent improvements:
  - Immobilization of bearer shares under the AktG amendments effective December 31, 2015, and requirement for shareholders’ register for AGs issuing registered shares.
- Recommendation focus:
  - Enhance transparency by requiring legal persons to collect and maintain accurate and up-to-date information on their beneficial owner(s), ensuring timely access to such information held by legal persons, and finalizing implementation of the 4th EU AML/CFT Directive requirement regarding a registry of beneficial owners.

### AML/CFT SUPERVISORY FRAMEWORK OVER BANKS (CROSS-BORDER OPERATIONS)
- Improvements made:
  - Audit Report Regulation establishes a checklist for auditors and requires assessment of compliance with specific AML/CFT obligations and implementation of enhanced AML/CFT audits when required.
  - BaFin uses fine-tuned risk weightings including higher weightings for group-wide implementation of AML/CFT measures and correspondent banking.
  - Guidance on implementation of the AML Act has been provided.
- Persistent implementation and supervision concerns:
  - Some German banks with cross-border operations have been subject to significant sanctions by foreign regulators for AML/CFT and sanctions violations with respect to overseas operations.
  - Need to enhance implementation of the Audit Report Regulation to ensure auditors pay special attention to banks’ risk assessments and control measures, including correspondent banking risks.
  - BaFin’s continued reliance on audit reports and banks’ internal assessments for AML/CFT supervision requires stronger enforcement of existing administrative obligations to account for group-wide cross-border risks.
  - BaFin’s AML/CFT supervisory staff is currently insufficient; entities per supervisor decreased from 200 in 2009 to about 124 in 2016.
- Supervisory and corporate governance recommendations:
  - Enhance banks’ group-wide risk management policies and controls at the parent level to identify, assess and mitigate ML/TF and related risks in overseas operations.
  - Improvements warranted in banks’ compliance and corporate governance frameworks, consolidated risk assessment and internal audit functions.
  - Enhance supervisory synergies between the ECB’s prudential supervision and BaFin’s AML/CFT supervision of significant banks, including joint onsite inspections and streamlined information exchange between ECB, BaFin and Bundesbank.
  - Strengthen collaboration between BaFin and the FIU concerning the quantity and quality of suspicious transaction reports.
  - Consider BaFin’s review of auditors’ working papers when warranted and increase BaFin DPML staff.

### MAIN RECOMMENDATIONS (Table 1 — summary)
- Ensure that the ongoing national assessment of ML and TF risks adequately addresses the risks that arise from cross-border banking operations.
  - Priority: High
- Increase the effectiveness of AML/CFT supervisory framework over cross-border banks, including by:
  - Taking additional measures to ensure that auditors’ reports adequately assess banks’ ML/TF risks and in particular banks’ group-wide risk management policies and controls to identify, assess and mitigate ML/TF risks.
  - Taking additional measures to ensure that the auditors’ reports comprehensively assess compliance with AML/CFT requirements as listed in Annex 6 of the Audit Report Regulation.
  - BaFin’s review when warranted of auditors’ working papers with respect to their assessment of risk assessment and mitigation.
  - More active BaFin AML/CFT supervision to complement external auditors’ reviews. Increasing staff of DPML.
  - BaFin leveraging off the ECB’s onsite supervision plans to conduct work associated with AML/CFT.
  - Enhancing information exchange between ECB, BaFin and Bundesbank on AML/CFT matters.
  - Strengthening collaboration between BaFin and the FIU including with respect to the quantity and quality of suspicious transaction reports.
  - Priority: High
- Enhance the transparency of legal persons incorporated in Germany, e.g., by:
  - Requiring these legal persons to collect and maintain accurate and up-to-date information on their beneficial owner(s).
  - Ensuring timely access to such information held by legal persons.
  - Finalizing the implementation of the requirement in the 4th EU AML/CFT Directive regarding the establishment of a registry of beneficial owners.
  - Priority: Medium
- As recommended in Germany’s last MER, ensure that the predicate offenses for ML include a broader range of serious offenses (including, in particular, single events of tax offenses committed by individuals that generate significant amounts of proceeds).
  - Priority: Medium

*Source: EXECUTIVE SUMMARY, GERMANY, INTERNATIONAL MONETARY FUND*

### 11.      As a member of the EU, Germany will need to transpose the Fourth EU Anti-Money

### _cr16190 - 11.      As a member of the EU, Germany will need to transpose the Fourth EU Anti-Money

### EU Fourth Anti-Money Laundering Directive and Transparency Register
- The Fourth EU Anti-Money Laundering Directive (4th Directive) must be transposed in full by June 2017.
- The Directive aligns the EU legal framework with the FATF 2012 standard and takes into account the European Commission’s review of the Third EU Anti-Money Laundering Directive.
- It includes measures to enhance transparency of legal persons and arrangements, notably through establishment of a central register of beneficial owner (BO) information.
- Germany is working on amendments to the AML Act to establish a new transparency register that will include information on beneficial owners not yet identified in existing registers.
- These amendments are due to be completed by June 26, 2017.

### Money Laundering Offense and Self-Laundering — recent changes and scope
- The 2010 MER found the ML offense met some but not all requirements of the standard, notably because:
  - Self-laundering was not criminalized.
  - Two FATF-designated categories of offenses were not predicates to the ML offense.
  - Legal persons could not be held criminally liable.
- Section 261 of the Criminal Code (CC) criminalized the physical elements of conversion, transfer, disguising, concealing and acquisition of the proceeds of crime, but originally excluded self-laundering.
- On November 26, 2015, amendments to the CC entered into force making self-laundering punishable under certain circumstances (modification to Section 261 (9)).
- The amended provision excludes exemption from liability “if the perpetrator or participant brings an object, which is a proceed of one of the unlawful acts named in subsection (1), second sentence, into circulation and, in doing so, conceals the unlawful origin of the object.”
- The authorities interpret “bringing into circulation” broadly to cover acts where:
  - (i) the perpetrator relinquishes control of the object (proceeds of crime);
  - (ii) a third person obtains control over it; and
  - (iii) the perpetrator conceals the unlawful origin of the object (creates impression of legal origin when dealing with the object).
- Examples given of punishable self-laundering conduct: depositing proceeds into an account in the perpetrator’s name; placing proceeds into a family member’s account; using proceeds to buy groceries or a car.
- The “possession” and some aspects of “use” of proceeds are not covered by the new offense where criminalization would contravene fundamental principles of German law:
  - Rule of law (“Rechtsstaatsprinzip” Article 20, paragraph 3 of the German Constitution).
  - Prohibition to punish someone twice for the same act (“ne bis in idem” Article 103 paragraph 3 of the German Constitution).
- The authorities and explanatory note indicate that possession or mere use typically accompany the predicate offense and are sanctioned by conviction for the predicate offense; only acts violating a protected legal interest (“geschütztes Rechtsgut”) other than that protected by the predicate offense may be punished as self-laundering.
- A legal opinion by University Professor Dr. Christian Schroder (commissioned by the Ministry of Justice) concluded that self-laundering (where a third party is not involved) is not punishable under a narrow definition, and that “No uniform principle of exemption from punishment emanating from immunity from criminal proceedings for instances in which perpetrators assist themselves after the fact can be justified by these means,” a view partly contradictory with enacted provisions.
- The exclusion of mere use and possession appears aligned with paragraph 151 of the MER and the current standard.

### Predicate Offenses to ML — in particular tax crimes
- In 2010 Germany included most but not all predicate offenses listed in the standard; insider trading and market manipulation were included as predicates but not criminalized, and counterfeiting and piracy of products were not covered.
- Amendments to the CC in 2011 included insider trading, market manipulation, counterfeiting and piracy of products as predicate offenses to ML.
- Tax crimes were predicate offenses to ML in Germany since 2001; the legal framework was refined in 2007.
- Section 261 (1) sentence 2 of the CC and related provisions incorporate a range of tax crimes as predicate offenses.
- Specific tax-related predicate offenses include:
  - Professional or violent smuggling (Section 373 of the Fiscal Code—Abgabenordnung).
  - Tax evasion (Section 370 of the Fiscal Code).
  - Receiving, holding or selling goods obtained by tax evasion in serious cases (Sec. 374 para 2 Fiscal Code).
- Predicate status for many tax crimes and some misdemeanors is contingent on aggravating criteria:
  - Committed “on a commercial basis” or by a “member of a gang.”
  - “On a commercial basis” refers to intent to commit repeated offenses to procure an ongoing source of income of some magnitude and for some duration; court rulings have held that the first tax crime motivated by pursuit of profit suffices to fulfil this condition.
  - Amounts generated by the offense are irrelevant for the “commercial basis” test; tax evasion committed by a gang or on a commercial basis is a predicate offense irrespective of the amount evaded.
  - A “gang” is broadly defined; Federal Court of Justice rulings require at least three people.
- Certain misdemeanors may be predicate offenses when committed on a commercial basis or by gang members.
- Concern: Some offenses that generate large proceeds may not be predicate offenses absent aggravating circumstances (e.g., tax evasion or some misdemeanors committed by individuals that generate significant proceeds).

### Conclusions and Recommendations (from the text)
- The criminalization of self-laundering strengthens the German ML offense.
- Read with the authorities’ explanations, the new self-laundering offense appears to be in line with the standard.
- The interpretation of the new offense—particularly the notion of “bringing into circulation”—could prove challenging and would benefit from clear court rulings.
- Germany should consider addressing offenses that produce large proceeds but are not predicate offenses due to aggravating requirements by:
  - Removing the aggravating requirement that the predicate offense was committed to make a profit or by a member of a gang; or
  - Including, in the tax crimes and misdemeanors, a reference to significant amount of proceeds of crime or a specific Euro threshold to ensure all serious crimes within FATF-designated categories constitute predicate offenses to ML.

### AML/CFT Supervisory Framework over Banks
- Single Supervisory Mechanism (SSM) comprising the ECB and national competent authorities entered into operation on November 4, 2014.
- The ECB directly supervises the significant institutions, which include 21 banking groups in Germany.
- National competent authorities (NCAs) supervise less significant institutions under the ECB’s general oversight.
- AML/CFT supervision in individual member states does not fall under the SSM supervisory framework; BaFin is in charge of AML/CFT supervision for both significant and less significant institutions in Germany.
- SSM-wide supervision considers AML/CFT as part of governance and broader compliance assessments but the ECB is not an AML/CFT supervisor.
- Information on ML/TF risks available to the ECB is based on:
  - Information provided directly by banks to the ECB;
  - BaFin’s and external auditors’ knowledge of institutional risk.
- BaFin is an operationally independent federal public authority under oversight of the Federal Ministry of Finance.
- BaFin is the lead prudential supervisor for about 1,974 credit institutions including branches and subsidiaries of foreign banks operating in Germany.
- BaFin is the sole designated supervisory authority for AML/CFT for the financial sector of Germany and conducts AML/CFT supervision through its Department for the Prevention of Money Laundering (DPML).
- The Bundesbank has no ongoing role in AML/CFT supervision.
- BaFin can apply sanctions for noncompliance with AML/CFT legislation and sector-specific laws.
- Consolidated supervision of financial institutions is conducted under the SSM-wide framework for prudential purposes and also for AML/CFT as part of governance and broader compliance assessment.
- BaFin, or the ECB in case of significant institutions, establishes prudential colleges of supervisors for consolidated supervision of groups; colleges aim to ensure cooperation with competent authorities in the EEA and non-EEA states.
  - These colleges are not specifically mandated to address AML/CFT issues; no AML/CFT colleges have been set up to date.
  - The EBA is discussing measures to enhance cooperation between EU AML/CFT supervisors, including establishment of AML/CFT colleges.
- Under the German Banking Act, BaFin can cooperate with other competent authorities, including supervisors within the EEA, with regard to AML/CFT.
- For less significant banks not covered under the SSM, BaFin must inform all members of a prudential college on an ongoing basis about relevant supervisory measures, including AML/CFT.
- Within the EEA supervisory framework, home supervisors supervise parent companies and group entities within domestic areas and branches abroad; host supervisors supervise subsidiaries abroad. Colleges can share AML/CFT issues even though they mainly deal with prudential issues.
- Within an EBA initiative, the majority of AML/CFT supervisors (including BaFin) preferred establishment of specific AML/CFT colleges.

*Source: _cr16190 (IMF).*

### 30.      BaFin, Bundesbank and other competent EEA authorities can share banking

### _cr16190 - 30.      BaFin, Bundesbank and other competent EEA authorities can share banking

### Information sharing and cross-border cooperation
- BaFin, Bundesbank and other competent EEA authorities can share banking information including:
  - disclosure of a group's legal and organizational structure;
  - management of the banking group;
  - information on adverse developments that could critically impair any member of the group;
  - information on any enforcement measures that BaFin has taken under the Banking Act.
- Sharing of information can include AML/CFT issues because AML/CFT legal violations can be sanctioned under the Banking Act, though no specific formal arrangements are in place to ensure consistent implementation.
- BaFin is proposing an MOU with the ECB that would cover AML/CFT matters.
- BaFin and Bundesbank have entered into information sharing arrangements with foreign supervising authorities outside the EEA through memoranda of understanding (MOUs); around 96 MOUs have been signed, which allow for cooperation on financial crimes including ML/TF.

### Prudential colleges and supervisory roles
- Under the Banking Act, prudential colleges of supervisors are established for institutions with cross-border operations.
- When BaFin is the home supervisor, it acts as the consolidating supervisor in the college; it also participates as host supervisor for subsidiaries or significant branches within the EEA or in third countries.
- Prudential colleges comprise EEA supervisors and third country supervisors depending on the group structure.
- Home and host supervisors must agree on their supervisory program according to the risk assessment of the group; as the AML/CFT supervisor for German banks, the risk assessment can include ML/TF risks.
- Host supervisors can receive AML/CFT audit reports of banks. Supervisor-to-supervisor cooperation also occurs through formal meetings with foreign regulators and can include AML/CFT issues.

### BaFin’s inspection powers and limits
- BaFin conducts general prudential inspections on banks domiciled outside Germany that are included in consolidation; powers to obtain information are sometimes limited and do not cover AML/CFT.
- Inspections focus on prudential risk management and the accuracy of data supplied for consolidation purposes; this also applies to subsidiaries domiciled outside Germany that are not included in consolidation.
- BaFin may require information or conduct audits of banks and subsidiaries with domestic and cross-border operations, and of financial or mixed financial holding companies, but the power to obtain information does not cover AML/CFT and is limited to monitoring the accuracy of information and returns sent for prudential consolidated supervision purposes.
- BaFin indicates it can require banks to provide information for AML/CFT purposes as it relates to their foreign branches or subsidiaries and can order audits to be performed abroad.

### AML Act and scope of obligations
- The AML Act is the centerpiece of German AML legislation and is generally applicable to all obliged entities as defined in the Act including the financial sector and DNFBPs; some provisions only apply to specific obliged parties.
- The AML Act includes customer due diligence, recordkeeping, policies and internal controls, suspicious transaction reporting, responsibilities of competent authorities and sanctions.
- Other financial sector laws and regulations contain additional AML/CFT provisions for specific sectors (e.g., banks and insurance companies).
- BaFin is the designated AML/CFT supervisor for all banks operating in Germany.

### Role of external auditors in AML/CFT supervision
- BaFin relies mainly on external auditors to assess banks’ compliance with AML/CFT requirements.
- The Audit Report Regulation defines the scope of AML/CFT obligations of auditors when conducting annual or targeted audits on behalf of BaFin; BaFin can also set the scope of auditors’ inspections when necessary.
- Annual audit reports cover both prudential and AML/CFT issues; for AML/CFT they focus mainly on banks’ AML/CFT policies and systems, including domestic and overseas banking operations.
- Audit reports are sent to BaFin’s DPML for analysis focusing on legal compliance and deficiencies in policies and systems.
- BaFin can conduct onsite inspections on its own or through auditors, and can conduct spot checks and “targeted” bank inspections on specific AML/CFT issues. BaFin is authorized under the Banking Act to instruct individual banks with respect to the scope of external auditors’ work.
- BaFin’s enforcement tools include issuing orders and instructions to banks, sanctioning banks or responsible individuals (including dismissal of managers, fines and license revocation).

### Audit Report Regulation and auditors’ required reviews
- Section 29 (2) of the Banking Act requires auditors to conduct annual audits with respect to compliance with the AML Act and relevant sections of the Banking Act.
- The Auditors Report Regulation (section 27 and Annex 5) requires auditors to make explicit assessments with regard to all issues mentioned in Annex 5.
- For credit institutions whose balance sheet total EUR 400 million or less, audits need only be conducted every two years unless the risk situation requires a shorter audit cycle.
- Auditor obligations under Annex 5 include explicit review of:
  a. Internal policies, adequacy of business and customer related controls to prevent ML/TF and fraud.  
  b. Functions, competencies, systems and resources of the AML officer and his/her deputy; for institutions not subsidiaries within the meaning of the Banking Act this applies to their subsidiaries and their foreign branches and subsidiaries.  
  c. Staff awareness and training on ML/TF and fraud methods, especially for staff executing transactions and initiating and establishing business relations.
- Auditors must assess compliance with CDD requirements (including enhanced due diligence in increased risk), recordkeeping, internal suspicious case reporting, and whether internal controls or CDD have been contractually outsourced.
- Under section 25l of the Banking Act, banks are required to apply group-wide AML/CFT controls; auditors must describe and assess implementation of uniform, group-wide AML/CFT control measures, and assess compliance where foreign state requirements are stricter than in Germany.
- Auditors can visit overseas branches and subsidiaries in their AML/CFT audit, but there is no specific requirement in the Audit Report Regulation to do so; external auditors often conduct overseas AML/CFT reviews jointly with local audit offices.

### Wire transfers, correspondent banking and account data retrieval
- Auditors must assess the extent to which credit institutions have complied with wire transfer requirements.
- Auditors must report on compliance with section 24c (1) of the Banking Act regarding recording of identification information in the account data retrieval system.
- Auditors must assess enhanced CDD obligations in correspondent banking relationships and whether associated risks are adequately addressed by risk management and control measures.

### BaFin’s risk-based AML/CFT supervisory approach and ratings
- BaFin adopts a risk-based approach consistent with its prudential supervision approach, allocating highest AML/CFT supervisory attention to banks with highest assessed ML/TF net risk as evidenced in auditors’ reports.
- Financial institutions are analyzed and rated (low, average or high) against five inherent risk criteria:
  - geographic location (high risk locations, including FATF country lists, media, or specific country events or information);
  - scope of business (regional, national, international);
  - products structure (high risk lines of business);
  - customer structure (e.g., nonresidents, PEPs);
  - distribution structure (e.g., use of branches, brokers, e-banking).
- BaFin regularly informs financial institutions (at least three times a year after FATF plenaries) by circulars about updates of FATF’s public statement on countries with strategic deficiencies; auditors also receive this information through their associations and must take the circular into account for audits.
- Quality of AML/CFT measures and controls in audit reports is assessed and rated by BaFin based on factors including adequacy of internal controls, CDD and compliance with other AML/CFT obligations; certain measures (e.g., role of the Money Laundering Compliance Officer, transaction monitoring, understanding customers’ business) are weighted more heavily.
- Final net risk classification by BaFin ranges from 1A (low risk-high quality of controls) to 3D (high risk–low quality of controls).
- As supervisory policy, large significant banks are classified as high for ML/TF risk.
- BaFin does not have access to external auditors’ working papers, other than those related to special audits commissioned by BaFin.

### Supervisory strategy tiers
- BaFin’s prudential and AML/CFT supervisory strategy is broadly based on risk ratings:
  a. Simplified basic supervision for low net risk entities.  
  b. Basic supervision for medium net risk entities.  
  c. Enhanced supervision for high net risk and significant entities.

### Interaction between AML/CFT and prudential supervision
- BaFin’s assessment of ML/TF risk does not specifically include broader prudential elements.
- The DPML operates independently of prudential supervision but liaises with BaFin’s Prudential Supervisory Directorates to ensure they understand banks’ ML/TF net risk profile.
- Prudential deficiencies could trigger a DPML assessment of whether similar deficiencies exist in AML/CFT controls; in general, prudential deficiencies do not directly affect the AML/CFT analysis, effectively implying two separate risk rating systems.

### Resources, supervisory activity and adequacy concerns
- BaFin’s section in charge of AML/CFT supervision of banks (GW 2) has on average one supervisor responsible for up to 124 banks, corresponding to each supervisor dedicating on average about 2-3 working days annually for each bank.
- BaFin’s DPML has a total of 110 staff, of which 40 are engaged in the data retrieval system and only 13 staff are directly involved in ongoing AML/CFT supervision of credit institutions.
- The number of banks per full time DPML staff declined from 150, in 2009, to 124, in 2016.
- There are some 1,974 banks subject to BaFin supervision.
- For large systemically important banks the number of days dedicated by each supervisor may not be sufficient as these banks are classified as high risk.
- GW 2 is responsible for onsite and offsite activities, mainly focuses on review of auditors’ reports, can order special AML/CFT audits, and its staff can accompany external auditors and participate in about 25 onsite visits each year, including large banks.
- The FSAP mission indicates BaFin should play a more active role in AML/CFT supervision to complement auditors’ reviews, particularly in areas where auditors have not adequately covered compliance and other supervision areas such as minimum risk management requirements (MaRisk Circular).

### Historical and recent supervisory activity data
- Number of targeted onsite visits in 2015: 33 in banks, 5 in branches of foreign banks, and 20–25 audit accompaniments.
- Small sized institutions have external audits every year; BaFin analyzes those reports only once every 5–10 years as they are considered low risk, but analyzes the Annex 5 list at least every two years and will check the report if the list contains significant negative assessments.
- AML/CFT reviews 2012–2014: 88, 26, and 28, respectively.
- AML/CFT reviews of branches of foreign banks 2012–2014: 11, 64, and 8, respectively.
- BaFin conducted targeted onsite examinations focused on the account data retrieval system (section 24c of the Banking Act): 2011: 8; 2012: 10; 2013: 10; 2014: 1; 2015: 10.
- BaFin carried out only three on-site AML/CFT inspections in 2014/2015 of foreign branches and subsidiaries of German banks.
- Branches of financial institutions domiciled in other EEA countries are not required by law to have annual audits and do not provide external auditors’ reports to BaFin; BaFin compensates via meetings on a rotating basis, meetings with the foreign bank industry association at least annually, requests for spot checks and internal audit reporting where these cover AML/CFT, and targeted audits where there is reason to believe there are shortcomings.
- Branches of German financial institutions operating abroad are included in consolidated prudential supervision and are subject to AML/CFT requirements (section 25l of the Banking Act) and included in annual external audits; subsidiaries are also subject to this requirement even if not subject to consolidated supervision.
- The number of branches and subsidiaries of financial institutions outside Germany are not consolidated by BaFin but reported individually by banks.
- When BaFin is not satisfied with auditors’ work, it can remove them using powers under the Banking Act; to date only a low number (3–4) of small audit firms have been disqualified from AML/CFT audits.

### Findings from the 2010 MER and outstanding recommendations
- In the 2010 MER, Germany was rated largely compliant with former FATF Recommendations 22 and 23 regarding application of AML/CFT measures in foreign branches and subsidiaries of German financial institutions, and AML/CFT supervision, respectively.
- With regards to Recommendation 22, scope limitations were cited and the following actions were recommended:
  a. Introduce enforceable measures requiring all financial institutions to pay particular attention to branches and subsidiaries in countries that do not, or insufficiently, apply the FATF Recommendations.  
  b. Ensure that the provisions of section 25g (now section 25l) of the Banking Act apply to subsidiaries and branches located in EEA and EU states.  
  c. Ensure that uniform standards are applied in the three principal sectors (banking, insurance and investment firms).  
  d. Implement an enforceable obligation for banks and investment firms to inform German supervisory authorities immediately when a foreign branch or subsidiary (including those in EEA states) is unable to observe appropriate AML/CFT measures.

*Source: _cr16190 - 30.*

### 50.      With respect to Recommendation 23 (and some elements of Recommendation 17 on

### _cr16190 - 50.      With respect to Recommendation 23 (and some elements of Recommendation 17 on

### Supervisory deficiencies identified in the MER and main recommendations
- MER highlighted that branches of German financial institutions were included in consolidated supervision, but subsidiaries were not.19
- Main recommendations to address identified supervisory deficiencies:
  - Ensure that members of the (supervisory) Board of Directors are explicitly subject to appropriate administrative fines for failure to supervise managers responsible for compliance.
  - Introduce legal provisions that explicitly allow the BaFin to dismiss managers and members of (supervisory) Boards of Directors for AML/CFT violations.
  - Review the adequacy of the frequency with which the high-risk institutions are subject to on-site inspection by the BaFin and the consequential impact on resources.
  - Address the issue of guidance on audit report quality as a priority with the auditing organizations in the cooperative banking sector.
  - Ensure that Länder authorities are sufficiently aware of their AML/CFT supervisory responsibilities and apply sufficient resources to supervise insurance intermediaries.

### Legislative and supervisory measures implemented (section 25l and audits)
- Section 25l now requires credit institutions to develop and implement group-wide compliance measures in particular in relation to due diligence and record keeping requirements and internal safeguards over their subordinated undertakings and branches. The senior managers shall be responsible for implementing this.
- Where measures to be implemented are not permissible or actually feasible in a non-EEA state in which the undertaking is domiciled, the superordinated undertaking or the parent undertaking must ensure that business relationships are not established or maintained n or should transactions be conducted in this non-EEA state. If a business relationship already exists, this relationship must be terminated.
- BaFin analyzed 2012 audit reports to review compliance with section 25g (now section 25l) of the Banking Act, resulting in BaFin ordering sixteen financial institutions to be audited for AML/CFT. Under these orders, auditors were required to review and report on:
  - whether German financial institutions have specific problems with the application of AML/CFT control measures by their foreign branches and subsidiaries consistent with section 25l; and
  - the implementation of formal group-wide AML/CFT internal controls and programs.
- Audit reviews showed practical and legal problems implementing section 25l stemming from:
  - restrictions imposed by data protection rules in certain countries;
  - difficulties in the identification of the beneficial owners; and
  - unsatisfactory documentation of controls.
- BaFin reports improved access to information since the MER but notes some cases where access to bank files is barred and BaFin seeks information from host supervisors, who are generally not (legally) required to share ML/TF risk assessment systems, methodologies, results of risk assessments, or institutional risk profiles.

### BaFin’s risk-based approach, correspondence relationships, and sanctions
- BaFin’s risk-based approach was recalibrated to change weightings applied to risk assessment factors: the multipliers for an institution’s risk regarding “Group-wide Compliance,” “Correspondent Banking Relationships,” and “Internal Controls” were increased from a multiplier of 1 to 3 (the multipliers are 1, 3, 6).
- BaFin obtains general information on banks’ correspondent account relationships from audit reports but banks are not required to inform BaFin on the ML/TF risk situation in countries where respondent banks are located, including in offshore centers. BaFin expects those risks to be integrated into banks’ risk analysis provided to BaFin.
- Recently, some German correspondent banks have been severing correspondent relationships with a large number of overseas respondent banks, suggesting those respondents represent unacceptable levels of ML/TF and/or legal compliance risk. This phenomenon may be partly prompted by severe sanctions applied by foreign authorities to a number of correspondent banks.
- When German banks are sanctioned abroad, foreign supervisors inform and provide BaFin with relevant information which is shared with respective bank auditors. BaFin has not applied sanctions on banks for non-compliance with national provisions in relation to sanctions applied against them in other countries, but has required banks to report to BaFin on measures taken by affected banks. No industry-wide review or action has reportedly been taken.

### Cross-border supervision, cooperation, and staffing
- BaFin can coordinate with foreign supervisors, from within the EEA and third countries, on AML/CFT issues under powers granted by the Banking Act. BaFin has cooperated with competent authorities of the U.S., Singapore, and the U.K.
  - Examples: a special audit in 2015 coordinated with U.K. supervision authorities; another audit planned in coordination with the Russian Federation authorities.
- BaFin can participate in or lead special audits to carry out targeted examinations to review group-wide deficiencies and compliance with AML/CFT obligations.
- Since the MER, BaFin has increased the number of staff that participate in special audits.
- Recent heavy sanctions by foreign supervisors on some German banks’ foreign branches for national AML/CFT violations have been considered in BaFin’s ongoing AML/CFT supervisory activities, but no specific supervisory action was reported regarding group-wide audit/inspection reviews or specific supervisory measures to deal with cross-border deficiencies.
- BaFin can inform foreign supervisors of deficiencies of overseas branches and subsidiaries to enable foreign supervisors’ action and can itself take measures to address such deficiencies.

### STR information, FIU relationship, and information flows
- Information obtained by BaFin on suspicious transaction reports (STRs) is limited. BaFin gets general information on compliance with the obligation to report suspicious transactions from audit reports and from the FIU and/or the Police.
- BaFin has been informed about concrete cases of non-compliance with reporting requirements by law enforcement agencies. Historically, it received STR information from some banks routinely but in 2016 BaFin informed banks to only report STR information to it if it related to significant or very serious suspected wrongdoing.
- STRs are an important source to assess effective implementation of AML/CFT policies and to evaluate banks’ monitoring and reporting systems. To enhance use of STR-related information, the relationship between the FIU and BaFin should be strengthened, e.g., through more frequent and formalized contact and sharing of information on the quantity and quality of STRs.
- BaFin meets with at least one of the regional police forces once a year or more to discuss STR and typologies issues; meetings with other LEAs are ad hoc.

### Conclusions: institutional and supervisory issues observed
- Institutional issues identified:
  - Need for enhanced group-wide risk management policies and controls at the parent level to identify, assess and mitigate ML/TF and related risks in overseas operations.
  - Insufficient updating of information on host country risks and applicable due diligence of host countries and foreign clients, including respondent banks.
  - Limited flow of information from overseas branches and subsidiaries in specific countries, limiting consolidated risk assessment at head office level; country-level secrecy and confidentiality restrictions may contribute.
  - Need for enhanced group-wide compliance and internal audit functions at head office and country level.
  - Institutional culture that was less risk averse.
  - Absence of risk information at the country level to make proper risk assessments, such as the lack of a national risk assessment.
  - Insufficient supervisory resources and an apparent need to reassess work of auditors, including enhanced review of their working papers when appropriate.
- Supervisory issues identified:
  - Absence of a national risk assessment (NR) in Germany that includes foreign/country sourced risks to support institutional and supervisory risk assessments, as well as AML/CFT audits. Germany is currently conducting an NRA.
  - Need to effectively monitor auditors’ reviews with respect to ML/TF risk assessments for consistency with BaFin’s risk-based framework to AML/CFT supervision.
  - Limited supervisory information on risks faced by banks in their foreign operations; BaFin mainly relies on assessments by external auditors which may not sufficiently address cross-border risks.
  - Unclear how, after the NRA is completed, risk information will be fed into the AML/CFT audit review process on which BaFin relies significantly.
  - Insufficient AML/CFT supervisory staff in BaFin in light of the proportion of entities per supervisor even though the ratio has decreased somewhat since 2009.
  - Fragmented prudential (ECB) and AML/CFT (BaFin) supervision for significant banks; while benefiting from interagency interaction, this may limit synergies that derive when prudential and AML/CFT supervision/onsite inspections are conducted by the same supervisor.

### Policy recommendations and actions urged
- Enhance the risk-based AML/CFT supervisory framework over banks with cross-border operations.
- Expedite completion of the NRA that includes an assessment of risks originating from foreign countries where German banks operate.
- Closely monitor effective implementation of the Audit Report Regulation to ensure auditors comprehensively assess compliance with AML/CFT requirements and take risk into account.
- Review and improve the quality of audit reports given BaFin’s main reliance on audit reports for supervisory risk assessments.
- Enhance banks’ group-wide risk management policies and controls at the parent level to identify, assess and mitigate ML/TF and related risks in overseas operations; improve compliance and corporate governance frameworks, consolidated risk assessment, and internal audit functions.
- Resolve any restrictions on sharing information within banking groups to ensure comprehensive understanding of group-wide ML/TF risks.
- Explore opportunities to enhance supervisory synergies between the ECB’s prudential supervision and BaFin’s AML/CFT supervision of significant banks, including joint onsite inspections and more explicit formalized information exchange.
- Increase BaFin’s AML/CFT supervisory staff due to the persistent high proportion of entities per supervisor.

### Transparency of legal persons — background and key statistics
- The most common types of legal persons in Germany are the limited liability company (Gesellschaft mit beschränkter Haftung, GmbH) and the AG.
- The GmbH includes a sub-category, the business company with limited liability that only requires a minimum share capital of one euro.
- AGs include both listed and unlisted corporations.
- There are (based on non-official estimates) about 1.15 million GmbHs and more than 15,000 AGs (about 530 listed on stock exchanges) operating in Germany.

*Source: IMF staff report content provided in the supplied excerpt from _cr16190.*

### 69.      The MER found that Germany did not have sufficient measures to prevent the misuse

### _cr16190 - 69.      The MER found that Germany did not have sufficient measures to prevent the misuse

### Summary of findings on transparency and access to beneficial ownership (BO) information
- The MER found that Germany did not have sufficient measures to prevent the misuse of legal persons for ML and TF purposes, noting specifically:
  - (i) there were no mechanisms in place to ensure timely access to information on the control and beneficial owners of legal persons other than the mechanisms available for publicly listed AGs; and
  - (ii) there was no transparency over non-publicly listed corporations that issue bearer shares, and over private foundations.
- There are three ways for the authorities to obtain BO information:
  - accessing information collected by reporting entities (facilitated for banks by the data retrieval system established pursuant to section 24C of the Banking Act);
  - requesting information from the legal person itself on the basis of courts orders; and
  - consulting company registers.
- The data retrieval system:
  - Is an online information system within BaFin and the central tax authorities, populated by credit institutions based on client information, including BO information.
  - Contains: account number, opening and closing dates, account holders and authorized person’s names and birthdates and the beneficial owner’s name and (if known) address.
  - Can be accessed by competent authorities without alerting the relevant banks or their customers and provides real time access (i.e., the information is provided with a couple of hours).
  - Information from the data retrieval system cannot be used as evidence but can be used as a basis to gather further evidence; competent authorities can compel non-banks and DNFBPs to provide BO information.
- Use of the data retrieval system (number of accesses):
  - The Bundeskriminalamt (BKA) - FIU: 2013 = 887, 2014 = 1,196, 2015 = 1,356
  - Federal Police (Bundespolizei): 2013 = 1,224, 2014 = 1,357, 2015 = 1,348
  - Other police agencies: 2013 = 73,185, 2014 = 86,989, 2015 = 73,185
  - BaFin: 2013 = 1,218, 2014 = 353, 2015 = 1,183
  - Tax authorities: 2013 = 13,397, 2014 = 13,401, 2015 = 13,003
  - Customs authorities: 2013 = 7,052, 2014 = 6,672, 2015 = 6,915
  - Public prosecutors: 2013 = 25,434, 2014 = 25,304, 2015 = 25,851
- Limits of the current system:
  - The current data retrieval system is populated with information from banks only; there is no similar mechanism for non-bank financial institutions and DNFBPs.
  - Pursuant to the AML Act, all financial institutions and DNFBPs enumerated in the Act are obliged to obtain BO information and to keep records, but these records are not part of the central data retrieval system.
  - Most natural and legal persons are likely to have bank accounts and thus be captured in practice, but a mechanism populated by reporting entities other than credit institutions would be helpful.
- Company registration and register information:
  - Registration is required for GmbH and AG to acquire legal personality and registration information is publicly available.
  - For GmbH, published information includes: company's name, domicile, business purpose, amount of share capital, date of execution of its articles of association, identity of managing directors (including signing authorities) and a domestic business address; GmbHs must submit and keep updated a list of shareholders; directors and notaries have a duty to submit updated lists and are subject to a coercive fine.
  - For AGs: notarized articles of association include name, registered office, objects and registered capital; listed AGs must disclose enterprises holding more than one fourth of the shares (section 20 of the German Stock Corporation Act) and meet transparency requirements for changes in 3, 5, 10, 15, 20, 25, 30, 50, or 75 percent of shares.
  - AGs that issue registered shares must keep an internal share-register (not publicly available); competent authorities may access this by necessary search or administrative orders; non-disclosure by shareholders can lead to preclusion of voting rights.
  - Company registers include the common register portal of the German federal states, the German Company Register or the Bundesanzeiger (Federal Gazette).
- Cross-border and multi-tier structures:
  - Competent authorities can trace ultimate beneficial owners if the shareholder is an entity registered in company registers; if the shareholder is a legal person registered abroad and the BO information is not in the data retrieval system, BO information must be obtained from abroad via international cooperation channeled through BaFin, the central tax authority, or the Ministry of Justice unless available in public registers.
- Timeliness:
  - Information in the data retrieval system is made available within two or three hours.
  - Information in company registers is publicly available online (www.handelsregister.de) and can be downloaded without delay.
  - Basic and BO information collected by reporting entities other than banks are not accessible within similarly short timeframes.

### Conclusions and policy recommendations
- Conclusions:
  - BO information is readily accessible in important cases, especially where credit institutions have collected it and it is available via the data retrieval system.
  - Weaknesses remain: neither bank data, company registers, nor direct requests to legal persons alone are sufficient to ensure adequate transparency in all cases.
  - Information collected by reporting entities other than banks may be difficult to obtain in practice, and legal persons are not specifically required to collect BO information.
  - Company registries do not necessarily include BO information in all instances.
- Recommendations:
  - Germany should ensure greater access to BO information.
  - Germany is encouraged to require legal persons to obtain and maintain information on their beneficial owners, and to ensure that competent authorities have timely access to that information.
  - Germany’s plan to implement the fourth Directive by setting up a new register which will include information on beneficial owners who are not yet registered on existing registers should also prove useful.

*Source: _cr16190 - 69.      The MER found that Germany did not have sufficient measures to prevent the misuse*

---


_Source: https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2016/_cr16190.pdf_