NEW BAFIN REQUIREMENTS: CHANGES IN RISK MANAGEMENT UNDER THE MONEY LAUNDERING ACT
The updated interpretation and application notes on the Money Laundering Act bring with them significant innovations and additions. Below we provide a compact summary of the key changes in the area of risk management.
Risk management - strengthening responsibility in corporate management
BaFin has tightened the requirements for companies' risk management in the context of combating money laundering. A key innovation is the obligation to explicitly appoint a member of management as the person responsible for proper risk management. This measure is intended to ensure that risk management is not only implemented operationally, but is firmly anchored in the company's management. Accountability for the management of money laundering risks is thus increased.
Special regulations apply to branches of financial institutions from other EU countries. In these cases, the permanent representative under commercial law must assume responsibility in accordance with the German Money Laundering Act (GwG). This ensures that foreign branches are also subject to the same high risk management requirements.
These changes significantly increase the organizational effort for companies. Smaller companies in particular, which previously had no explicit person responsible for risk management, must now provide additional resources. The transfer of responsibility to a member of management also means that the management must be directly involved in the management and control of money laundering risks. This can lead to increased internal control, but also to an increased administrative burden. Companies must revise their internal structures and define clear responsibilities for risk management. Management must be more closely involved in the processes, which leads to increased responsibility and more time being spent. Documenting and reporting on compliance with the new requirements requires more intensive monitoring and regular reviews of risk management processes.
Risk analysis - specification of the analysis and monitoring requirements
In addition to strengthening risk management, BaFin has also specified the requirements for risk analysis. A particular focus of the new AuA is the prevention of terrorist financing, which is now explicitly considered separately from combating money laundering. In order to clarify this distinction, the obligation to carry out separate risk analyses for both areas has been introduced.
However, for a well-founded risk assessment, it is not enough to consider only general sources of risk. Companies must systematically record both specific risk factors for money laundering and terrorist financing. These include the risk factors listed in Annexes 1 and 2 of the AMLA as well as findings from the National Risk Analysis and other relevant sources of information. This is intended to ensure that companies obtain a comprehensive understanding of the threat situation.
A clear separation of risk areas is essential, particularly in the case of terrorist financing, as this is often fed by legal sources and therefore requires separate consideration. Furthermore, companies are obliged to regularly update their risk analyses. New developments, trends and ad-hoc information must be continuously incorporated into the assessment, meaning that a one-off analysis is no longer sufficient.
Another important aspect is reviewing the effectiveness of existing security measures. Companies must evaluate whether there are still residual risks despite existing measures and take additional measures if necessary. If weaknesses are identified, corrective action must be taken immediately. This can include adjustments to business activities as well as changes to the risk strategy or internal security mechanisms.
Ultimately, BaFin requires companies to develop targeted prevention measures based on their risk analysis. These measures must not remain static, but must be regularly reviewed and adjusted if necessary. A measure is only considered effective if it is appropriate to the company's specific risks and demonstrably contributes to reducing money laundering risks. Companies must significantly refine and adapt their risk analysis processes, which leads to increased effort in data collection and evaluation. The obligation to regularly update the analysis requires a continuous monitoring process and dynamic adjustment of measures. The explicit separation of money laundering and terrorist financing risks leads to more detailed documentation and possibly to additional internal controls. Reviewing the effectiveness of security measures requires greater involvement of compliance and risk management departments, which increases the resources required.
Conclusion
The revised BaFin requirements significantly tighten the requirements for companies in the area of money laundering prevention. The introduction of clearly defined responsibility for risk management at management level increases accountability and requires structural adjustments within organizations. At the same time, the new requirements for risk analysis demand a more detailed and continuously updated assessment of risks, which increases the administrative and operational burden.
Companies must therefore revise their internal processes, optimize their risk monitoring systems and ensure that their measures are always in line with current threats. Despite the increased requirements, however, the more precise regulation also offers opportunities: companies that implement efficient systems and processes at an early stage can improve their security standards in the long term and minimize regulatory risks.
