Procedure descriptions

Show commissioning of third parties with internal security measures

As an obliged entity under money laundering law, you must create appropriate business and customer-related internal security measures in order to manage and minimise the risks of money laundering and terrorist financing through suitable principles, procedures and controls.

You can also transfer the implementation of internal security measures to a third party within the framework of contractual agreements. However, you must first notify the competent supervisory authority of the intended outsourcing. The Money Laundering Act contains standard examples of the security measures to be put in place. This list is not exhaustive. Further internal security measures may be required in individual cases. The internal security measures also require the approval of the member of your company's management responsible for money laundering prevention.

As an obliged entity, you may have the internal security measures carried out by an (external) third party within the framework of contractual agreements if you have notified the supervisory authority in advance. The supervisory authority may prohibit the transfer if

  • the third party does not guarantee that the security measures will be carried out properly.
  • the control options of the obligated party are impaired or
  • supervision by the supervisory authority is impaired.

For you as the obliged entity, this means that you must state in your notification that the conditions for prohibiting the transfer are not met.

You must also state in the notification which internal security measures are the subject of the outsourcing

The notification must be made by the obliged entity itself or, if applicable, by the appointed money laundering officer.

Important note:

The responsibility for the fulfilment of the internal security measures remains with the obliged entities. If, for example, the third party does not properly fulfil the contractually assigned obligations, you remain responsible for non-compliance with the internal security measures.

Responsible authority

The regional council in whose district you live.

Regierungspräsidium Stuttgart

Hausanschrift

Ruppmannstraße 21
70565 Stuttgart
To the electronic timetable information

Contact

Telefon 0711 904-0
Fax 0711 904-11190
E-Mail poststelle@rps.bwl.de
Servicekonto Sichere Servicekonto-Nachricht über service-bw.de senden

Details

Prerequisite

Obligated Persons under the Money Laundering Act

  • Only natural persons or legal entities who are obligated parties under the Money Laundering Act are eligible to file a report.
  • The reporting person must be a member of the management level or internal/external money laundering officer or internal/external money laundering officer of the company.

The third party must be:

  • be sufficiently qualified and reliable, provide assurance that the safeguards are properly implemented, and
  • not impair the management options of the obligated parties or the supervision of the supervisory authority as a result of the outsourcing.

Procedure

  • The notification must be submitted to the competent supervisory authority by the obligated party itself or, if applicable, by the appointed money laundering officer
  • Your notification will be examined by the competent authority
  • You will receive a final notification
  • After notification, the internal security measures can be carried out by a third party; prior approval by the authority is not required.
  • The supervisory authority can prohibit the transfer to a third party if
    • the third party does not provide a guarantee that the security measures will be carried out properly,
    • the management options of the obligated parties are impaired as a result, or
    • the supervision by the supervisory authority is impaired

Deadlines

  • Notification of outsourcing of internal security measures must be made prior to outsourcing
  • After notification, the internal security measures can be carried out, prior approval of the authority is not required.

Required documents

  • Notification of the outsourcing of internal security measures
    • The notification must clearly state which internal security measures are to be outsourced.
    • The notification of outsourcing must also state in full and in writing that all requirements have been met and that there are no grounds for prohibiting the intended outsourcing.
  • Proof of authorisation to notify
    • Proof of appointment as an anti-money laundering officer or anti-money laundering officer or
    • Contract on the outsourcing of internal security measures or
    • Proof that the reporting person is a member of the company's management (e.g. extract from the commercial register or shareholders' agreement)
  • Contract with the third party
    • Copy of the contractual agreement with the third party to whom the security measures are to be outsourced.
  • current excerpt from the commercial register, if applicable
    • Registered companies should submit a current extract from the commercial register with the notification. Legal entities in the process of being founded (GmbH, AG) must submit the articles of association or articles of incorporation.
    • Please note: The authority may request proof of the service provider's suitability - this could be, for example, CVs, training certificates or references that explicitly relate to obligations and experience under money laundering law.

Costs

none

Legal basis

Gesetz über das Aufspüren von gewinnen aus schweren Straftaten (Geldwäschegesetz - GwG):

  • § 6 Absatz 1 Interne Sicherungsmaßnahmen
  • § 6 Absatz 7 Interne Sicherungsmaßnahmen

Release note

Machine generated, based on the German release by: Innenministerium Baden-Württemberg, 20.05.2025