Germany

In Germany, the AML compliance program and officer obligations under the German Money Laundering Act (GwG) and the Banking Act (KWG) entail an obligation that is continuous in nature and is distinguished by a continuous (real-time / daily) time value. The above obligations are mandated in Section 6 and Section 7 of the GwG, as well as the MaRisk circular issued by BaFin, in which all financial and non-financial obliged entities are obligated to create a continuous risk management system. This involves having a continuous risk management system, which entails the appointment of a Money Laundering Reporting Officer (MLRO / Geldwäschebeauftragter) with absolute executive authority to conduct continuous corporate surveillance. In terms of its operation, the continuous tracking is continuous within the organization's environment and consists of performing continuous automated screening of the global asset freezing database, continuous real-time transaction monitoring, and continuous analysis of risks within the organization (Risikoanalyse) to prevent the financial exploitation of the market. The above structural demands are overseen within a two-tiered arrangement by BaFin and Deutsche Bundesbank, where not observing these active daily controls attracts serious administrative penalties.

According to the German Money Laundering Act (GwG), the Anti-Money Laundering Record Retention requirement is defined strictly as a retention requirement and is regulated by a fixed time period, namely 5 years. This statutory obligation, which has been established according to Section 8 of the GwG and clarified by BaFin, implies that obliged financial and non-financial institutions shall store customer due diligence (KYC), risk assessment, and transaction history in a reliable, unalterable form. In contrast to a general calendar plan, the five-year period will commence at the moment of closing of an account in the case of customer identification records and at the end of the execution year in the case of individual transaction records. The requirement guarantees that a full financial audit trail is entirely organized and available immediately for the BaFin, the Deutsche Bundesbank, the FIU, and the judiciary in the process of a money laundering investigation, irrespective of any GDPR requests for erasing data.

As per the German Money Laundering Act (GwG), the concept of Customer Due Diligence (KYC/CDD) is understood to be an obligation in real-time/daily terms [GwG, MaRisk]. This main compliance requirement, which has been developed pursuant to sections 10 to 15 of the GwG and interpretative guidelines by BaFin, requires that obliged financial and non-financial institutions continuously monitor their customer base rather than performing static identity verification [GwG]. The system functions in real time and ensures that all customer information, transaction patterns, and socio-economic information undergo dynamic monitoring, where automated checks are performed daily against the worldwide sanctions list and PEP database [GwG, MaRisk]. It is also characterized by various risk-based tempos of operation which range from triggering immediate update of data in case of suspicious transactions to conducting periodic reviews in accordance with the risk levels of clients [GwG, MaRisk]. All information must also remain fully auditable by BaFin and the Deutsche Bundesbank.

In accordance with the German Money Laundering Act (GwG), the Suspicious Transaction Reporting regime refers to an event-based requirement driven by the strict time value of immediate / without delay. The legal requirement, which has been stipulated by Section 43 of the GwG and put in place through the German Financial Intelligence Unit (FIU), requires that as soon as a compliance officer or a Money Laundering Reporting Officer (MLRO) determines the existence of a suspicion that funds or a transaction is associated with money laundering, tax evasion, or terrorist financing, a formal electronic report shall be made immediately through the goAML portal. Contrary to the calendar-based procedure, this requirement shall arise only in response to the occurrence of an irresolvable transaction warning or risky conduct on the part of the client. Practically, the report shall be made before undertaking the transaction to afford the FIU or prosecutors regulatory powers to block or immediately after the execution of the transaction in case there is no absolute block.

Under this regulatory regime, it is required that there should be the perpetual establishment of a proper legal basis under which the statutory requirement shall be fulfilled under Article 6(1)(c) of the GDPR, and there should also be continuous provision of transparent privacy notices to the clients about monitoring and storage of data. This process of privacy data management is not something sporadic but is performed concurrently with customer monitoring. In addition, it includes specific time-bound benchmarks for performance, and companies are required to implement standard data processing policies and respond to data subject access requests, as well as investigations carried out by data protection authorities, within 1 month deadline (which can be extended to 3 months in cases of complicated architecture), except when limited under AML exemptions to avoid tipping off suspects.

In accordance with GDPR and the BDSG, the obligation to report a personal data breach in Germany is an event-based one, which is characterized by a very strict and divided time value of 72 hours. The above-described legal requirement entails the following: when a company or a financial institution learns about any incident leading to the unauthorized access to, the altering, and the loss of the personal data, the reporting obligation arises. At that, the reporting entity should contact the respective regional State Data Protection Authority (Landesdatenschutzbehörde) within no more than 72 hours with the information about the breach, the type of data that was breached, and the measures taken in order to prevent further negative consequences. In case the reported incident poses a threat to individual rights and can lead to identity theft and financial fraud of the clients, the affected individuals have to be informed without any delays.