Germany AML for Accountants: GwG, WPK and BStBK Guidance

Germany's anti-money laundering (AML) law is the Geldwäschegesetz, known as the GwG. For accountants it works through two professional chambers: the Wirtschaftsprüferkammer (WPK) for public auditors, and the Steuerberaterkammern, coordinated by the Bundessteuerberaterkammer (BStBK), for tax advisers. This guide draws on the WPK's interpretation and application guidance adopted on 17 October 2024 and the BStBK's guidance adopted on 27 January 2026. Where those documents do not let us confirm something, such as reporting deadlines and fines, we say so rather than fill the gap.

Who supervises whom

The WPK is the competent supervisory authority for Wirtschaftsprüfer and vereidigte Buchprüfer (WP/vBP) under section 51(8) sentence 1 of the GwG. They are obliged entities under section 2(1) no. 12. The WPK also holds that audit and accounting firms (WPG/BPG) are directly obliged. For tax advisers (Steuerberater and Steuerbevollmächtigte), the competent authorities are the regional Steuerberaterkammern under sections 50 no. 7 and 51(1). The BStBK states that its guidance becomes binding only once the relevant regional chamber approves it, so check your own chamber's position.

Risk management and the risk analysis

Both chambers' guidance is built around the written risk analysis. Section 5(1) of the GwG requires every obliged party to identify and assess its money laundering and terrorist financing risks. Under section 5(2), the analysis must be documented, reviewed at least once a year and made available to the chamber on request. The WPK recommends three steps: analyse your structure, analyse your business and client risks, and rate the risks as high, medium or low. A documentation exemption can be applied for, but the WPK says applications are often nearly as burdensome as documenting the analysis, and the analysis itself must still be carried out. The WPK also says a member of management must be responsible for risk management and compliance under section 4(3), a role that firms may combine with the money laundering officer.

Internal safeguards, and the ten-professional rule

Section 6 of the GwG sets out internal safeguards such as policies, controls, staff vetting, training and independent review. Both chambers describe an order under section 6(9) under which most of these safeguards apply only where more than ten professionals work in the practice, unless more than 50% of turnover comes from trustee activities. The WPK says the risk analysis and other duties still apply to smaller practices. Other points from the guidance:

• section 6(5) requires an anonymous internal channel for reporting violations;
• section 6(6) requires the firm to be able to tell the financial intelligence unit (FIU), on request, whether it had a business relationship with a given person in the previous five years;
• section 6(7) allows safeguards to be outsourced with at least one month's prior notice to the chamber, and responsibility stays with the firm.

When you need a money laundering officer

Section 7(1) of the GwG, which requires a money laundering officer (Geldwäschebeauftragter), does not apply to WP/vBP or tax advisers directly. Instead, the chambers can order one under section 7(3). The WPK's order of 6 October 2017 requires an officer and a deputy where a practice has more than 30 WP/vBP or members of professions that may practise jointly with them. The BStBK says its chambers' orders require an officer and deputy where more than 30 professionals work in the practice. The appointment must be notified to the chamber in advance. The WPK adds that the officer must be based in Germany, report directly to management and has protection against dismissal for one year after removal.

Customer due diligence

Section 10(1) of the GwG covers identification, clarifying the beneficial owner, understanding the purpose of the relationship, checking politically exposed person status and ongoing monitoring. Under section 10(3), due diligence is triggered by:

• establishing a business relationship;
• a transaction outside a relationship of EUR 15,000 or more (section 10(3) no. 2b), with the WPK noting that aggregation to avoid the threshold can be caught;
• suspicion of money laundering or terrorist financing, regardless of any threshold;
• doubts about previously obtained identity data.

Identification should generally happen before the relationship starts (section 11(1)), though the WPK accepts completion when the signed engagement letter is returned in normal-risk cases. Existing clients must be updated on a risk basis (section 10(3a)). The BStBK states that a certified copy of an identity document is not sufficient proof of identity. Simplified due diligence under section 14 applies only in lower-risk cases, and you must be able to show the chamber your measures were adequate (section 10(2)). For the principles behind this, see our guides to customer due diligence in accountancy practices and ultimate beneficial ownership.

Reporting suspicions to the FIU

The reporting duty is in section 43(1) of the GwG. The WPK says the threshold is well below the initial suspicion needed to open a criminal investigation under section 152(2) of the Code of Criminal Procedure, and that certainty is not required. Reports go through the FIU's online portal, goAML. The copies of the guidance we read did not include the reporting deadline or the portal registration rules, so we cannot state them here.

What we could not confirm

• The reporting deadline in section 43 and the portal registration rules.
• The tipping-off rule in section 47. Both chambers' guidance lists the topic, but the text we read did not include it.
• Record retention under section 8. The WPK notes client files are typically kept for ten years in line with section 51b(2) of the Wirtschaftsprüferordnung, but the GwG retention period itself was not in the text we read.
• Fines under section 56, which both documents list but whose text was not available.
• Your own regional Steuerberaterkammer's orders, and any updates after January 2026.

Practical steps: our suggestions

These are our suggestions, not requirements of the GwG or the chambers.

1. Confirm whether your chamber has issued orders under sections 6(9) and 7(3), and how many professionals count towards each threshold.
2. Review your written risk analysis at least annually and date each review.
3. Check that your onboarding process does not rely on certified copies of identity documents.
4. Test your route to the FIU portal before you need it.
5. Read the GwG sections on reporting, tipping off, record keeping and fines in full.

For comparison with another European regime, see our guide to the Netherlands Wwft.

Frequently asked questions

Which chamber supervises German auditors?

The Wirtschaftsprüferkammer, under section 51(8) of the GwG.

Do I always need a money laundering officer?

Not by default. Under the chambers' orders, one is required where a practice has more than 30 professionals, according to the WPK and BStBK guidance.

Is there a transaction threshold for due diligence?

For one-off transactions outside a business relationship, EUR 15,000 or more triggers it under section 10(3) no. 2b. Suspicion triggers it at any amount.

This guide is general information, not legal advice. Check the current GwG text and your chamber's orders.