AML Due Diligence Germany: M&A Checklist 2026

AML due diligence Germany sits at the centre of every serious acquisition strategy in 2026, as the phased introduction of the new EU Anti-Money Laundering package, including the directly applicable Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624), sits alongside Germany’s established Geldwäschegesetz (GwG) and reshapes what acquirers and their advisers must verify before signing. For corporate development teams, private equity sponsors and in-house counsel, the stakes have never been higher: administrative fines, criminal exposure and the risk of unwinding a completed transaction all follow from inadequate anti-money-laundering diligence. This guide translates the legal framework into a practical, transactional playbook, pre-sign, pre-closing and post-closing, mapped to the relevant GwG provisions and to guidance from the FIU, BaFin and the European Commission.

Read it as a working checklist rather than a policy overview.

Quick reference: AML due diligence checklist (at-a-glance)

Before diving into the legal detail, deal teams need a workable map of what happens and when. AML due diligence in German M&A breaks naturally into four stages, each with its own required checks, responsible owner and escalation trigger. Treat the table below as the spine of your workflow and adapt the escalation thresholds to the risk profile of the target and the jurisdictions in its ownership chain.

• Pre-sign. Collect corporate constitutional documents, shareholder lists and ultimate beneficial owner (UBO) declarations; run initial KYC and sanctions/PEP screening; identify high-risk jurisdictions in the ownership chain.
• Pre-close. Resolve red flags, obtain seller warranties and remediation undertakings, complete enhanced due diligence where triggered, and confirm no unresolved suspicious-transaction concerns remain.
• Closing. Confirm escrow/holdback mechanics are in place for any residual AML exposure, verify source-of-funds documentation, and record final screening evidence with timestamps.
• Post-close. Integrate KYC and monitoring controls, execute remediation plans, and confirm any reporting obligations are discharged.

A printable version of this AML due diligence checklist can be issued to every workstream lead at kick-off so responsibilities and escalation points are agreed before diligence begins.

Legal framework: EU AMLR and the Geldwäschegesetz (GwG), what changed

The German anti-money-laundering regime rests on the Geldwäschegesetz (GwG), the domestic statute that transposes and supplements EU standards. From 2024 onwards, the EU adopted a major reform package, comprising the directly applicable Anti-Money Laundering Regulation (AMLR), a sixth Anti-Money Laundering Directive, and a regulation establishing a new EU Anti-Money Laundering Authority (AMLA), headquartered in Frankfurt. The substantive obligations under the AMLR are set to apply from mid-2027, with member states transposing the accompanying directive over the same period, so 2026 is a transitional year in which the GwG remains the operative national statute while institutions prepare for the harmonised regime the European Commission has driven.

The practical consequence for acquirers is greater consistency of expectations across borders, tighter UBO verification standards, and heightened supervisory scrutiny of internal controls, all of which feed directly into deal diligence. Deal teams should confirm the applicable commencement dates for each instrument, as the phasing is staggered.

Key GwG sections to know

The obligations that matter most in an M&A context cluster around customer due diligence and reporting. In practice, deal teams should be familiar with:

• § 10 GwG, general customer due diligence measures, including identification of the contracting party and the beneficial owner and assessment of the business relationship.
• § 43 GwG and the following reporting provisions, the reporting regime, covering the obligation to report facts giving rise to suspicion of money laundering, the mechanics of reporting to the Financial Intelligence Unit, the prohibition on tipping off, and related protections. These provisions are the operational core of any suspicious-transaction analysis in a transaction.

The consolidated statutory text is available through Gesetze im Internet, and every citation in a diligence memo should point to the specific section relied upon rather than to the statute generally, and should be checked against the current consolidated version.

Cross-border enforcement and the BaFin/FIU roles

Two authorities dominate the German landscape. The Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin) supervises obliged entities in the financial sector and publishes expectations for AML systems and controls; its enforcement posture is a reliable barometer for how rigorously internal procedures must be documented. The Financial Intelligence Unit (FIU), housed within the General Customs Directorate (Generalzolldirektion, part of the German customs administration / Zoll), is the central authority to receive suspicious-transaction reports. Because the EU reforms emphasise coordination across member states, reinforced by the new EU-level authority AMLA based in Frankfurt, cross-border deals now demand that acquirers consider not only German obligations but the interlocking expectations of other EU supervisors where the target has operations or owners abroad.

Effective AML due diligence Germany work therefore treats the GwG as the anchor and the EU framework as the surrounding context.

Pre-sign due diligence: target-level KYC and UBO verification

The pre-sign phase is where most AML risk is either surfaced or missed. This is the window in which acquirers still have maximum leverage to demand information, insist on remediation, or walk away without contractual penalty. A disciplined approach to KYC checks for German acquisitions and to beneficial ownership verification pays for itself many times over.

Documents to request

Build the request list around what you must independently verify rather than what the target volunteers. At minimum, request:

• Incorporation and constitutional documents, together with a current commercial register (Handelsregister) extract.
• Complete shareholder lists and, where corporate shareholders exist, the ownership chain up to natural persons.
• Signed UBO declarations identifying every beneficial owner in accordance with § 10 GwG standards.
• The target’s own recent KYC files, AML policies and evidence of prior screening, so you can assess the maturity of existing controls.
• Source-of-funds and source-of-wealth documentation where the ownership profile or transaction structure warrants it.

How to use the Transparenzregister

The Transparenzregister is the German beneficial-ownership register and should be a primary verification tool, not an afterthought. Step-by-step, the verification runs as follows: query the register for the target entity, extract the recorded beneficial owners, and compare those entries against the shareholder lists and UBO declarations obtained directly from the seller. Where the register, the shareholder register and the sworn declarations diverge, that discrepancy is itself a red flag requiring resolution before signing. For layered ownership structures, trace each corporate shareholder up the chain and repeat the query until you reach the natural persons who ultimately own or control the target. Retain redacted screenshots and query timestamps as diligence evidence.

A dedicated supporting guide on Transparency Register checks in German acquisitions covers the register mechanics in greater depth.

When to demand seller warranties and remediation

Where diligence surfaces gaps that cannot be closed before signing, an incomplete ownership chain, a nominee arrangement, or missing source-of-funds evidence, the answer is rarely to abandon the deal outright. Instead, escalate the finding to the SPA negotiation: demand specific UBO and AML compliance warranties, require the seller to complete named remediation steps as a condition to closing, and reserve the right to price adjustment or termination if the position deteriorates. The red-flag scoring table below helps standardise how findings are triaged across the deal team.

Enhanced due diligence for PEPs, sanctions and high-risk jurisdictions

Where the standard risk assessment identifies elevated exposure, the GwG and the EU framework require enhanced measures rather than routine checks. This is central to AML due diligence Germany practice, because PEP involvement, sanctions nexus or a high-risk-country connection materially changes both the evidentiary burden and the internal approval path.

Screening frequency and tools

PEP screening in Germany and sanctions screening should not be a single pre-sign event. Run initial screening at target identification, refresh it before signing, and repeat immediately before closing to capture any change in status, sanctions designations and PEP classifications can shift during a deal timeline. Layer commercial PEP and adverse-media databases over the consolidated public lists, and record the date, time and dataset version of each screen so the evidence trail is defensible under supervisory scrutiny.

What constitutes enhanced measures

Enhanced due diligence under the GwG (see § 15 GwG) typically means deeper source-of-funds and source-of-wealth verification, senior-management interviews, higher internal approval thresholds before proceeding, and more frequent ongoing monitoring. The Financial Action Task Force (FATF) standards frame this as a risk-based approach: the intensity of measures scales with the assessed risk, and PEPs in particular attract mandatory enhanced scrutiny. In a transactional setting this frequently translates into contractual protections, warranties, pricing adjustments and specific indemnities, alongside the diligence itself.

Escalation matrix for PEP and sanctions hits

Every hit needs a predetermined route. A sanctions match against a shareholder or the target itself should stop the process pending legal analysis of whether the deal can lawfully proceed at all. A PEP identification should trigger enhanced measures and senior approval but does not by itself prohibit the transaction. Adverse media requires assessment for credibility and relevance. Documenting who decides, on what evidence and within what timeframe converts screening output into governable decisions rather than unresolved noise on the diligence tracker.

Suspicious transaction reporting (STR/SAR) in M&A transactions

The reporting regime under the GwG is where AML due diligence Germany work intersects most sharply with legal risk. Deal teams and their advisers must understand not only when a suspicious-transaction report is required, but how reporting interacts with confidentiality, privilege and the deal timetable.

When an acquirer or adviser must file with the German FIU

Under the GwG, obliged entities must report to the FIU where there are facts indicating that assets are connected to money laundering, terrorist financing or a predicate offence, or where a customer has failed to disclose beneficial ownership. Whether a particular acquirer or adviser is an obliged entity depends on its status under § 2 GwG; financial institutions and certain designated professionals fall within scope. The trigger is the existence of factual grounds for suspicion, not certainty and not a completed investigation. Once that threshold is met, the reporting obligation crystallises independently of the deal’s commercial logic.

Decision tree, evidence threshold and privilege considerations

A structured decision path keeps reporting decisions consistent and defensible:

1. Is the entity or adviser an obliged party under § 2 GwG? If not, the statutory reporting duty may not apply, though contractual and reputational considerations remain.
2. Do the facts give rise to a suspicion that assets stem from a criminal offence or relate to money laundering or terrorist financing? If yes, proceed to reporting analysis.
3. Do legal-professional-privilege considerations apply? Lawyers face specific rules balancing reporting duties against professional confidentiality, and the Bundesrechtsanwaltskammer (BRAK) provides guidance on where those boundaries fall.
4. File the report to the FIU where the obligation is engaged, and observe the prohibition on tipping off, the target and, in some cases, the counterparty must not be alerted to the filing.

Practical timing: pre-close versus post-close reporting

Timing is delicate. A suspicious-transaction concern arising before closing may require a report while the deal is still live, which raises acute confidentiality issues given the anti-tipping-off rules. Coordination with the seller must be handled so as not to compromise the filing. In some scenarios the appropriate response is to pause closing, secure funds in escrow, and take legal advice before any further step. Internal escalation language should make clear that a potential reporting obligation is a legal decision reserved to compliance and counsel, not a commercial judgement for the deal team.

Transaction structuring and contract remedies for AML risk

Diligence identifies risk; contract structure allocates and mitigates it. Where AML concerns cannot be fully eliminated before signing, the SPA becomes the instrument for managing residual exposure. Three tools dominate: warranties, indemnities and escrow. Choosing between them, and combining them, is the practical craft of managing AML risk in German deals.

Warranties and indemnities

AML warranties typically require the seller to confirm that the target has complied with the GwG, that UBO disclosures are complete and accurate, and that no suspicious-transaction concerns are outstanding. Breach gives rise to a damages claim, subject to the usual limitations. Indemnities go further, providing a pound-for-pound recovery for a specified risk, for example, losses arising from a pre-closing money-laundering exposure, often without the causation and quantification hurdles that constrain warranty claims.

Escrow and holdback structures

Where funds themselves may be tainted, or where an FIU matter or criminal investigation is unresolved at closing, an escrow or holdback allows part of the consideration to be retained pending clearance. This is the natural mechanism when a diligence issue cannot be conclusively resolved before signing but the parties wish to proceed. Release conditions should be tied to defined events, for example, confirmation that no FIU proceeding is pending or completion of a remediation step.

MACs and termination rights

Material-adverse-change clauses and specific termination rights tied to AML findings give the acquirer an exit where the risk profile deteriorates between signing and closing, for instance, if a sanctions designation lands on a shareholder or an investigation is opened. Drafting these triggers with precision avoids disputes over whether an AML development qualifies.

Post-closing integration: remediation and monitoring

The reporting duties and diligence obligations do not end at completion. Post-closing, the acquirer inherits the target’s AML posture and must integrate it into the group’s own controls. This phase closes out the residual risk identified during AML due diligence Germany work and establishes ongoing compliance.

Transition of KYC and monitoring controls

Fold the target’s customers and counterparties into the acquirer’s KYC and transaction-monitoring systems, re-screening where the acquired records are stale or where the inherited controls fell short of BaFin expectations. Any gaps flagged during diligence should have a named owner and a completion deadline.

Notification obligations and remediation timelines

Execute the remediation plan agreed in the SPA, completion of missing UBO verification, refreshed source-of-funds documentation, or correction of Transparenzregister entries where the target’s filings were deficient. Where remediation reveals facts giving rise to suspicion, the reporting analysis under the GwG re-engages.

When to self-report and remediate

If post-closing review uncovers historical non-compliance, early self-reporting and demonstrable remediation typically place the acquirer in a stronger position with supervisors than a discovered failure. The decision to self-report is a legal one, informed by BaFin’s supervisory posture and the specific facts, and should be taken with counsel.

Practical tools and vendor checklist

Robust AML due diligence Germany work depends on layered screening infrastructure rather than a single database query. Build the screening stack so that no single dataset is a point of failure.

Recommended screening layers

• Consolidated sanctions lists (EU and UN and, where a US nexus exists, OFAC), together with relevant German notices from BAFA and BaFin.
• Commercial PEP databases for shareholders, directors and connected parties.
• Adverse-media screening for reputational and predicate-offence signals.
• Ownership registries, the Transparenzregister and the Handelsregister, for UBO and corporate verification.

Evaluating provider SLAs and data coverage

When selecting third-party screening providers, assess data freshness, jurisdictional coverage, false-positive rates and the auditability of results. Providers should deliver timestamped, exportable evidence that satisfies supervisory expectations. Coverage of the jurisdictions in the target’s ownership chain matters more than headline dataset size.

Case studies and worked examples

Two short scenarios illustrate how the framework operates in practice.

Scenario A, cross-border PE buyout with undisclosed UBO. A sponsor pursuing a mid-market German target found that the Transparenzregister entry did not reconcile with the shareholder list, and one corporate shareholder traced to a high-risk jurisdiction with no disclosed natural-person owner. Applying § 10 GwG standards, the sponsor halted signing, demanded a complete ownership chain, and made resolution a condition precedent. When the seller could not close the gap, an indemnity and an escrow were structured to cover the residual exposure, with release tied to confirmation that no FIU matter was pending. The deal proceeded on protected terms rather than blind.

Scenario B, mid-cap acquisition with a PEP shareholder. Screening identified a politically exposed person among the target’s shareholders. Rather than abandon the transaction, the acquirer applied enhanced due diligence under the GwG and FATF risk-based principles: source-of-funds verification, senior-management interviews and higher internal approval. The findings were clean, but the SPA nonetheless carried specific AML warranties and a monitoring undertaking, and the position was refreshed immediately before closing to capture any change in the shareholder’s status.

Conclusion: next steps and compliance sign-off

Executing AML due diligence Germany work in 2026 is a sequenced, owner-driven discipline rather than a box-ticking exercise. The essential next steps are clear: agree the four-stage checklist and escalation triggers at kick-off; run and refresh KYC, UBO, PEP and sanctions screening at each milestone; escalate red flags through a defined matrix; reserve suspicious-transaction reporting decisions to compliance and counsel; and structure warranties, indemnities and escrow to allocate residual risk. Assign each workstream to a named owner, legal for statutory interpretation and reporting, compliance for screening and monitoring, and the deal team for information gathering, and lock the timeline against the signing and closing dates.

Done well, disciplined AML due diligence Germany protects the transaction, the acquirer and the individuals responsible for sign-off.

Sources

1. Geldwäschegesetz (GwG), Gesetze im Internet
2. European Commission, Anti-Money Laundering and Countering the Financing of Terrorism
3. Financial Intelligence Unit (FIU), Zoll (Germany)
4. Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin), AML Supervision
5. Transparenzregister (German Transparency Register)
6. Financial Action Task Force (FATF), Recommendations
7. Bundesrechtsanwaltskammer (BRAK)