SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsgwg-risikoanalyse

gwg-risikoanalyse

General & other

View repository

Updated 10-15 20:08

About this skill

/geldwaesche-aml-kyc:gwg-risikoanalyse

Purpose

The skill generates the basic framework of a documented risk analysis pursuant to Section 5 GwG, assigns risk factors to the four mandatory categories (customer, product / service, distribution channel, geographical risk) and derives from them the level of due diligence obligations (Sections 10, 14, 15 GwG). It ensures that the analysis takes into account the Supranational Risk Assessment of the European Commission and the National Risk Assessment of the BMF and is updated at least annually or on an ad hoc basis.

⚠️ Currency (as of 2026-07): The legal basis of the risk analysis continues to be Section 5 GwG. The EU AML package will not replace the GwG today, but on 10.07.2027 — however, the transition must already be included in the analysis and in the trigger for updating:

  • AMLA (Regulation (EU) 2024/1620) has been operational in Frankfurt am Main since 01.07.2025. It will supervise selected obliged entities directly and otherwise coordinate the national supervisory authorities.
  • AMLR (Regulation (EU) 2024/1624) applies from 10.07.2027 as directly applicable Single Rulebook — without a national implementing law.
  • AMLD6 (Directive (EU) 2024/1640): transposition deadline for Art. 11–13, 15 (beneficial ownership registers) expired on 10.07.2026; general transposition deadline 10.07.2027.
  • The majority of AMLA level 2 / level 3 measures was due by 10.07.2026 ; around 23 RTS/ITS and guidelines are still outstanding — including specifications on risk assessment and risk factors.
  • EU-wide cash payment limit of EUR 10,000, Member States may set lower limits — relevant for the risk category "product/service" in cash-intensive business. [unverifiziert - prüfen]

Consequence for this skill: The forthcoming AMLR changeover is an ad hoc reason for updating within the meaning of Section 5(2) GwG. The analysis must be structured in such a way that it can be switched over to the AMLR on 10.07.2027 (see step 7a).

Inputs

  • Type of obliged entity pursuant to Section 2 GwG (credit institution, financial services provider, insurer, asset manager, lawyer / tax adviser / notary, goods trader above the threshold, real estate agent, precious metal / art dealer, gambling provider, crypto custodian)
  • Business model (product portfolio, customer groups, distribution channels, geographical reach)
  • existing risk analysis (if available, with date and last update)
  • supervisory framework (BaFin / Customs / state supervisory authority)
  • special incidents since the last analysis (suspicious activity reports, audit findings, sanction proceedings)

Sub-agent architecture

Researcher provides § 5 GwG [German Money Laundering Act] with reference to § 4 (risk-based approach) and § 6 (internal safeguards), supranational + national risk analysis, BaFin and FIU interpretation guidance as well as commentary passages. Drafter creates the risk analysis document with methodology, risk factor matrix, risk classes and derivation of the level of obligations. Reviewer checks completeness of the four categories, documentation density, update cycle and linkage to § 6 GwG safeguards.

Process

1. Obligated party status

Clarify before starting which number of § 2 I GwG applies — the scope of obligations varies (e.g. § 2 I No. 1: credit institutions; No. 10: lawyers / tax advisors / notaries only for catalog activities; No. 14: goods traders only from the cash threshold within the meaning of § 4 V GwG). In the case of multiple classifications, the stricter obligations regime applies in each case.

2. Methodology of the risk analysis (§ 5 GwG)

The risk analysis must be available in writing, traceable and document the choice of methods. Common:

  • qualitative assessment per risk factor (low / normal / high)
  • quantitative weighting (e.g. scorecard)
  • aggregated risk class per business relationship / transaction

Standard and minimum content: Herzog, GwG, Xth ed. year, § 5 marginal no. 1 et seq. [unverifiziert – Auflage prüfen]; BaFin, Interpretation and Application Guidance on the GwG, General Part.

3. Include external sources

  • Supranational risk analysis of the European Commission (Art. 6 Directive (EU) 2015/849, every two years)
  • National Risk Analysis (NRA) of the BMF (last updated; specific edition [unverifiziert – Stand prüfen])
  • Sectoral risk analyses of the competent supervisory authority (BaFin for banks / insurers / FDI; regional RAK / StBK / chambers of notaries; Customs-FIU; gambling authority)
  • EU list of high-risk countries (delegated regulation of the COM pursuant to Art. 9 Directive 2015/849)
  • FATF Recommendations and FATF country lists

4. Four risk categories (§ 5 I GwG)

Category Example indicators (non-exhaustive)
Customer natural / legal person; sector; PEP status § 1 XII GwG; nominee structures; cash-intensive business; existing customer vs. new customer
Product / service products with anonymity potential (bearer instruments, e-money, crypto), cross-border payments, correspondent banking relationships, trade finance
Distribution channel face-to-face onboarding vs. remote identification (video identification, eID); intermediaries / referrers; non-regulated intermediaries
Geographic risk EU high-risk country list; FATF lists; offshore centres; sanctioned countries (UN, EU, OFAC); corruption index (TI CPI)

5. Risk classes and level of obligations

Risk class Level of obligations Norm
low (with demonstrated justification) simplified due diligence § 14 GwG
normal general due diligence § 10 GwG
high (PEP, high-risk country, complex structure, unusual transaction behaviour) enhanced due diligence § 15 GwG

The classification must not be blanket — each class is to be applied to the specific business transaction.

6. Link to § 6 GwG (internal safeguards)

The risk analysis must result in concrete safeguards: customer acceptance procedures, monitoring, employee reliability, training, AML officer (§ 7 GwG, at credit institutions + deputy, MaRisk AT 4.4.3). Without this link, the risk analysis is formally incomplete.

7. Updating

At least annually and on an ad hoc basis (new products, new markets, changed supervisory guidelines, new NRA / SNRA, visible change in the threat landscape). Updates are to be documented with date, occasion and responsible person.

7a. Preparation for AMLR, AMLA and AMLD6

The transition to the EU AML package is not a future topic, but an ad hoc updating trigger under § 5 II GwG. Four workstreams belong in the analysis and in the action plan:

a) Gap mapping of the existing GwG procedures onto the AMLR (effective date 10.07.2027). Each obligation anchored in the risk analysis is mapped to the corresponding AMLR provision and classified as identical, tightened (plan for process and IT lead time) or eliminated/deviating. Important: the AMLR is fully harmonising — national additional requirements that are taken for granted today cannot simply be continued. The mapping is to be documented and provided with responsibilities and deadlines.

b) Align UBO data with the 25% threshold. The implementation deadline for the register provisions (AMLD6 Art. 11–13, 15) expired on 10.07.2026. The analysis must reflect the data quality on beneficial owners as a separate risk factor of the "customer" category — in particular in the case of multi-tiered and cross-border participation chains.

c) Monitor the AMLA level 2 pipeline. Around 23 technical standards and guidelines are still open; they specifically flesh out the risk assessment. In the risk analysis, a person responsible for monitoring is to be named, and determinations that depend on standards still outstanding are to be marked as provisional .

d) Review selection for direct AMLA supervision. Obliged entities with cross-border activity and an elevated risk profile may be placed directly under AMLA supervision. The self-assessment ("Do we come into consideration?") belongs in the risk analysis; if this results in realistic candidate status, documentation depth, data quality and points of contact must be raised accordingly. Selection criteria and timetable must be verified against the AMLA Regulation and AMLA publications. [unverifiziert - prüfen]

8. Fine risk

A breach of duty within the meaning of Section 5 GwG is an administrative offence under Section 56 I No. 6 GwG [unverifiziert – konkrete Nr. prüfen]. Fine range for intentional violations up to EUR 1 million or 10% of annual total turnover (Section 56 III GwG).

Sources and citation style

Binding: ../../../references/zitierweise.md.

Statute

Administrative provisions

  • BaFin, interpretation and application notes on the GwG, General Part and Special Part Credit Institutions
  • FIU interpretation and application notes (for the non-financial sector)
  • BMF, National Risk Analysis [unverifiziert – aktuellen Stand prüfen]
  • European Commission, Supranational Risk Assessment, COM(2022) 554 final [unverifiziert – aktuelle Ausgabe prüfen]
  • MaRisk (AT 4.4.3 Compliance Function, BT 5 ML Prevention)

Commentaries

  • Herzog, GwG, Xth edition year, Section 5 marginal no. 1 et seq. [unverifiziert – Auflage prüfen]
  • Bülte, GwG, Section 5 marginal no. 1 et seq. [unverifiziert]
  • Kreitmair, GwG, Section 5 marginal no. 1 et seq. [unverifiziert]
  • Quedenfeld, Handbuch Bekämpfung Geldwäsche und Wirtschaftskriminalität, Xth edition, chapter on risk management [unverifiziert]

Case law ([unverifiziert – prüfen in juris])

  • Fine case law on Section 56 GwG (supervisory and administrative courts, occasionally KG / OLG) — specific case numbers cannot be reliably recalled in model knowledge; research in juris using the search string "GwG Risikoanalyse Bußgeld".

Output format

RISIKOANALYSE — § 5 GwG
Verpflichteter: <Firma / Kanzlei>, § 2 I Nr. <…> GwG
Stand: <Datum>   Verantwortlich: <Name GW-Beauftragter>
Letzte Aktualisierung: <Datum>   Nächste Wiedervorlage: <Datum + 12 Monate>

I.   Methodik
     - Bewertungslogik (qualitativ / quantitativ / Scorecard)
     - Berücksichtigte externe Quellen (SNRA, NRA, BaFin-AuA, FATF)

II.  Risikofaktoren
     1. Kunde
        - <Faktor> → Bewertung (niedrig / normal / hoch) → Begründung
     2. Produkt / Dienstleistung
     3. Vertriebsweg
     4. Geografisches Risiko

III. Risikoklassen und Pflichtenniveau
     - niedrig → § 14 GwG (vereinfachte Sorgfalt)
     - normal → § 10 GwG
     - hoch   → § 15 GwG (verstärkte Sorgfalt)

IV.  Interne Sicherungsmaßnahmen § 6 GwG
     - Kundenannahme, Monitoring, Mitarbeiterschulung, GW-Beauftragter

V.   Aktualisierungsregime
     - jährlich + anlassbezogen

V-a. Übergang EU-AML-Paket
     - Gap-Mapping GwG → AMLR (Stichtag 10.07.2027): <Stand, Verantwortlicher, Termin>
     - UBO-Datenqualität / 25-%-Schwelle (AMLD6 Art. 11–13, 15; Frist 10.07.2026): <…>
     - AMLA-Level-2-Pipeline (offene RTS/ITS/Leitlinien): <Monitoring-Verantwortlicher>
     - Kandidat für direkte AMLA-Aufsicht? <ja / nein / offen — Begründung>

VI.  Risiken / offene Punkte
     🟢 / 🟡 / 🔴 <Einstufung mit Begründung>

VII. Quellenverzeichnis

Example (excerpt, legal opinion style)

III. Risk classes and level of duties

The business relationship with a medium-sized GmbH based in Germany without a PEP connection and without a high-risk country connection falls into the "normal" risk class according to the indicators compiled under II. Therefore § 10 I GwG applies (general due diligence obligations: identification of the contracting party, clarification of the beneficial owner pursuant to §§ 10 I No. 2, 11 V GwG, clarification of the purpose and intended nature of the business relationship, ongoing monitoring). Simplified due diligence pursuant to § 14 GwG does not come into consideration because a demonstrably low risk situation within the meaning of § 14 I GwG is not substantiated; the blanket argument "domestic medium-sized business" does not hold (cf. Herzog, GwG, § 14 marginal no. 12 et seq. [unverifiziert]).

Risks / typical errors

  • Risk analysis as a "drawer document" without linkage to concrete safeguarding measures (§ 6 GwG) — formal violation, risk of fine pursuant to § 56 GwG.
  • Blanket classification as "low risk" without justification of simplified due diligence under § 14 GwG — supervisory authorities and FIU-AuA require case-by-case justification.
  • PEP status disregarded — § 1 XII GwG also covers foreign and domestic public officials as well as family members; without a structured PEP screening, § 15 III GwG is violated.
  • No updating for > 12 months or despite a new NRA / EU high-risk list — violates § 5 II GwG.
  • AML officer without a deputy for obligated entities with a corresponding obligation (§ 7 GwG in conjunction with sector-specific rules) — MaRisk violation for credit institutions.
  • AMLR/AMLA transition ignored — from 10.07.2027 the fully harmonized obligations of the AMLR apply directly. Anyone who only begins gap mapping in 2027 no longer has any lead time for IT and process adjustments.
  • AMLR already used today as the audit standard — until 10.07.2027, § 5 GwG is the legal basis of the risk analysis. An analysis based on the AMLR is currently unusable for supervisory purposes.
  • Waited for a national AMLR implementation act — the AMLR is a regulation and applies directly; only AMLD6 is implemented nationally.
  • Underestimated full harmonization — national additional requirements from the GwG cannot simply be continued under the AMLR. The gap mapping must also identify eliminated obligations, not only gaps.
  • UBO data quality not reflected as a risk factor — the AMLD6 deadline for the register provisions (Art. 11–13, 15) expired on 10.07.2026 ; incomplete chains above the 25% threshold are a typical audit finding.
  • AMLA level-2 standards still open treated as final — around 23 RTS/ITS and guidelines are still pending; determinations based on them must be marked as provisional and assigned a monitoring officer.
  • Direct AMLA supervision not assessed in-house — AMLA (operational in Frankfurt since 01.07.2025) directly supervises selected obligated entities; the self-assessment belongs in the risk analysis.