Geldwäschebeauftragter (§ 7 GwG): Germany’s AML officer

Every German payment and e-money institution must name a Geldwäschebeauftragter and a deputy under § 7 GwG, and tell BaFin before either takes up or leaves the post. The statute is short. The working rules sit in chapter 3.2 of BaFin’s Auslegungs- und Anwendungshinweise (AuA), General Part, July 2025: who may hold the role, the two-week notice, the 15-FTE limit for board members, and outsourcing. Since June 2025 the notice also has its own MVP-Portal procedure. This guide covers the regime, the filing, the ZAG overlap and what Article 11 AMLR changes from 10 July 2027.

1. Who must appoint, and at what level

§ 7(1) GwG requires obliged entities under § 2(1) nos. 1 to 3, 6, 7, 9 and 15 to appoint an AML officer auf Führungsebene and a deputy. Number 3 covers payment and e-money institutions under § 1(3) ZAG and the German branches of comparable institutions seated abroad, so a passported EMI with a German branch is inside § 7(1). Agents and e-money agents (§ 2(1) no. 4) need an officer only if BaFin orders one under § 7(3), as AuA section 1.5 confirms.

Under § 1(15) GwG, a member of the Führungsebene is an executive or senior employee with enough knowledge of the entity’s ML/TF risks and enough authority to take decisions on them. They need not sit on the board. The officer is responsible for AML compliance, but management keeps its own responsibility, and the officer sits directly below the board. That line runs to the board member designated under § 4(3) GwG, who also approves the risk analysis and the internal safeguards.

The AuA adds the points supervisors check:

• tasks, responsibilities and powers of officer and deputy are set out in writing; several deputies are allowed where cooperation is ensured;
• a board member may be officer or deputy, as a rule, only where the entity has fewer than 15 full-time equivalents, no suitable staff below board level and a risk position that allows it. Past AML shortcomings can rule this out;
• the officer may not also be data protection officer, save under strict documented conditions, and may not perform internal audit;
• combining the role with compliance or risk controlling at the same level is accepted; any other tie, such as to legal, must be documented with reasons.

2. Location, language and independence

§ 7(5) GwG requires the officer to work in Germany and to be the contact point for law enforcement, the FIU (Zentralstelle für Finanztransaktionsuntersuchungen) and the supervisor. The officer needs enough powers and resources and unrestricted access to all relevant information, data, records and systems, and reports directly to management. Management may instruct the officer in general, but not on a planned report under § 43(1) or a reply to an FIU request under § 30(3).

The AuA relaxes the location rule for the deputy only: a deputy may be based abroad if they will work from Germany whenever they actually stand in. Either the officer or the deputy must, as a rule, speak enough German to deal with the authorities without delay. § 7(7) protects both: no disadvantage because of the role, and dismissal only for good cause justifying termination without notice, for the term and one year after it ends.

3. The § 7(4) notice: what, when, and how

Under § 7(4) GwG, appointment and removal of the officer and the deputy are notified to the supervisor in advance, and BaFin can require an appointment to be revoked where the person lacks qualifications or reliability. AuA 3.2.1 treats notice as timely if it arrives at least two weeks before the person starts or stops. BaFin may ask for evidence of qualifications (career overview, AML training) and reliability (an extract from the Bundeszentralregister and, where relevant, the Gewerbezentralregister).

Since 13 June 2025, entities supervised by BaFin under § 50 nos. 1 and 2 GwG file through the MVP-Portal procedure Geldwäscheprävention und Terrorismusfinanzierung. BaFin’s information sheet (May 2025) says a successful MVP submission replaces notice by post or email, and sets three steps:

1. Register as a company contact person with a business email address; the “natural person” option does not apply. The link to complete registration is valid for 72 hours.
2. Apply for admission to the procedure as a direct filer or as a third-party filer. Filing opens only when the status is “accepted”, which can take several days.
3. Submit the form Bestellung/Änderung/Entpflichtung der/des (stv.) Geldwäschebeauftragten, choosing appointment, change or release.

Three traps. To replace an officer, file the release first, then the appointment. “Change” is only for new details of a person already appointed, such as contact data or a new surname. And the on-screen confirmation is only a dispatch receipt: the filing counts only when the log (Protokoll einsehen) shows “Meldung akzeptiert”. BaFin reviews the content afterwards and comes back if it has questions or objects to the person.

Save the PDF of the submitted form, as BaFin recommends. Auditors will ask for it, and the FIU’s goAML registration needs a designation letter to the supervisor, which the PDF can evidence — see § 43 GwG reporting through goAML.

4. Where the ZAG and the ZAGAnzV come in

The officer notice is a GwG notice to BaFin through the MVP procedure. It is not one of the § 28 ZAG events governed by the ZAG-Anzeigenverordnung, which go to BaFin and the Bundesbank together. The regimes meet in two places:

• Outsourcing the function. Under § 6(7) GwG, a third party may perform internal safeguards only after prior notice to the supervisor; AuA 3.10 treats two weeks before the start as timely and says outsourcing an internal safeguard is always material under § 26 ZAG. A payment institution that outsources the officer role therefore also files the § 26(2) ZAG notice with the § 8 ZAGAnzV data set and records it in its outsourcing register.
• Managing directors. If a board member becomes officer under the small-entity exception, the § 28(1) no. 1 ZAG file and the § 7(4) GwG notice are two separate filings.

5. Outsourcing the officer: allowed, but tightly framed

The AuA expressly allows outsourcing of the officer or deputy function. The § 6(7) notice names the provider, the start date and the person acting as officer or deputy, and shows in writing that none of the three ban grounds applies: no assurance of proper performance, impaired management control, or impaired supervision. Sending the contract alone will not usually do, and providers in high-risk third countries are excluded. Under AuA 3.2.6 the entity keeps an internal contact person, the responsible board member must be able to get information directly from the provider, and a multi-client provider must give the role enough resources. Work done by a foreign parent, head office or branch also counts as outsourcing, and responsibility stays with the obliged entity.

6. The German rules against Article 11 AMLR

Regulation (EU) 2024/1624 (AMLR) applies from 10 July 2027 (Article 90). Article 11 sets a two-role structure, covered in our AMLR internal-governance guide.

Two planning points. Article 18(3)(e) keeps suspicious activity reporting in-house or within the group in the same member state, so an outside provider filing SARs today needs a different set-up by July 2027. And the AMLR applies directly, but how German law adapts § 7 GwG around it will decide the deputy, the location rule and the notice route; check the text in force rather than assume today’s rules carry over.

7. Worked case: a passported EMI opens a German branch

Facts: an EMI authorised in another member state opens a Zweigniederlassung in Berlin; its group MLRO works from head office.

Applicable rule: § 2(1) no. 3 GwG brings the branch into § 7(1); the officer must work in Germany (§ 7(5)); the appointment is notified in advance (§ 7(4)).

What the compliance officer does: hires or seconds a Germany-based officer at Führungsebene with enough German, and names the group MLRO as deputy only if they will work from Germany when standing in. Registers on the MVP-Portal, gets admitted, files at least two weeks before the start date, and keeps the accepted PDF for goAML.

Outcome: an accepted officer before the first German customer is onboarded.

8. Worked case: the officer resigns

Facts: a German PI’s officer resigns with four weeks’ notice; the deputy covers until a hire starts in two months.

Applicable rule: release and appointment are both notified in advance, release first; § 7(7) protection runs for a year after the release.

What the compliance officer does: files the release as soon as the date is fixed, documents the deputy’s interim mandate, files the new appointment two weeks before the start with CV, training evidence and a criminal-record extract ready, and updates goAML users.

Outcome: no gap, two accepted filings in the right order.

9. Worked case: a ten-person PI outsources the function

Facts: a small PI wants a specialist provider to supply its officer, with its CEO as deputy.

Applicable rule: § 6(7) GwG and AuA 3.10 and 3.2.6 (prior notice, written showing on the ban grounds); material outsourcing under § 26 ZAG; a board-member deputy is possible below 15 FTE.

What the compliance officer does: files the § 6(7) notice two weeks ahead naming provider and individual, the § 26(2) ZAG notice and the § 7(4) notices; gives the CEO a direct information right against the provider; documents why the CEO is a suitable deputy.

Outcome: a defensible set-up, with a 2027 note that SAR filing cannot stay with an outside provider.

FAQ

What to do, today

• Compliance: confirm you hold the accepted MVP PDF (or older letter) for both officer and deputy.
• Board: minute the § 4(3) GwG member and the officer’s written mandate and reporting line.
• HR: reflect § 7(7) protection, including the one-year after-period, in both contracts.
• EEA branches: test the “in Germany” and German-language rules against the people in post.
• 2027: map the officer to the AMLR compliance officer, name the compliance manager, and review any outsourced SAR filing.

Related: MVP-Portal — registering and filing with BaFin · § 43 GwG suspicious transaction reports via goAML · AMLR compliance manager and compliance officer · PCF-52 Head of AML (Ireland) · Article 2d Wwft: the Dutch compliance function · AML officer roles compared across the EU