Investment Sources and Banking Compliance Processes in Germany: AML/KYC Risks (Legal Guide)

February 27, 2026

Law, Blog, General, legal solutions, companies, Commercial Law, countries, Citizenship by Investment

This section explains how banks in Germany conduct source of funds checks under AML/KYC regulations, identity verification under the GwG (Geldwäschegesetz), UBO/Transparenzregister, PEP – high-risk – crypto checks, transaction monitoring, and suspicious transaction reporting (FIU/goAML) processes when investing.

Investment Sources and Banking Compliance Processes in Germany: AML/KYC Risks

In Germany, investors entering the market by establishing a company, increasing capital, purchasing real estate, or making financial investments often encounter difficulties with the commercial registry , but with banking compliance processes. Opening a bank account, transferring capital, regular collection/payment flows, funds coming from abroad, and especially high-value one-off transfers, lead banks to thoroughly investigate the "source of the investment" within the framework of AML/KYC.

In this article, I explain the basic legal framework in Germany (GwG), the practical KYC lifecycle of banks, the “source of funds / source of wealth” logic, the UBO/Transparenzregister connection, the increased scrutiny in areas such as PEP – high-risk countries – and crypto assets, and the suspicious transaction reporting mechanism. The aim is to help you anticipate risks from an investor's perspective and prepare your file accordingly.

Legal note: This text is for general informational purposes only. In a specific case, the bank's risk appetite, the sector, ownership structure, the country of origin of the funds, and transaction patterns may alter the outcome.

1) The legal basis of AML/KYC in Germany: GwG and “obligors” (Verpflichtete)

In Germany, the fundamental framework for combating money laundering and terrorist financing the Geldwäschegesetz (GwG). The GwG defines certain professions and sectors, including banks, as "liable." For example, credit institutions (banks) are among the liable entities under the GwG. (Gesetze im Internet)

1.1. Main KYC steps that banks must follow

The General Law of the Internet ( GwG) systematically regulates the “customer due diligence/duties of care” that must be fulfilled when establishing and maintaining a customer relationship. The general framework is found in §10 (Allgemeine Sorgfaltspflichten) and subsequent articles ( Gesetze im Internet ) .

In practice, the following are some topics that shouldn't be surprising when a bank asks you for information:

Identification and verification of the customer's identity (natural person / legal entity)
Verification of the authority of the person acting on behalf of the legal entity
Identification of the actual beneficiary (UBO / wirtschaftlich Berechtigter)
Understanding the purpose and nature of the employment relationship
Ongoing monitoring (Gesetze im Internet)

2) What does "source of investment" mean? That's the main question the bank is asking

The most common mistake investors make is this: a bank doesn't just ask "where did you get the money?"; a bank's needs are often twofold:

Source of Funds (SoF): The source of the fund: This refers to the trail of the money flow, showing "from which account, through which transaction, and through which stages" the specific transfer/capital originated .
Source of Wealth (SoW): In a broader perspective, how an investor's total assets were legitimately generated (business income, company sale, inheritance, real estate sale, etc.).

SoF is more “transaction-based”, SoW is more “profile-based”. The bank prefers to implement both together, especially for high-value or unusual transactions.

3) How does the banking compliance process work? (Onboarding → monitoring → periodic updates)

3.1. Onboarding (account opening) – the busiest document period

In Germany, especially a company account , banks want to clearly see the existence and control structure of the legal entity. Typical examples of KYC documents for individuals and legal entities are also summarized by payment institutions (such as identity documents, proof of address, and registration documents). (Stripe)

Frequently requested requirements specific to the company (GmbH/UG) :

Commercial register / Handelsregisterauszug
Company agreement (Satzung)
Signature samples similar to the director appointment decision and signature circular
List of partners / share distribution
UBO declaration (ultimate beneficiary)
Business model summary + expected annual turnover/transaction volume + main customer/supplier profile
If a capital investment is to be made, the file regarding the source of the capital.

3.2. Ongoing monitoring – “Is everything normal?”

In the GwG system, once a relationship is established, "monitoring" continues; the bank tracks the transaction pattern (frequency, amount, country, sender/recipient). The connection between this framework and the "continuous monitoring" logic in §10 is important. (Gesetze im Internet)

3.3. Periodic update (Re-KYC)

In recent years, the era of "file opened and closed" has ended. Banks update customer data at regular intervals. Summaries of BaFin's comments show that update periods are discussed according to risk level (e.g., less frequent for medium risk, annual for high risk). (Deloitte Italia)

4) UBO and Transparenzregister: The “backbone” of KYC

One of the questions the bank often asks is: Who is the ultimate owner of the company? This isn't just a bank form; in Germany, the Transparenzregister is at the heart of the transparency regime.

The Transparenzregister help pages contain typical information that needs to be reported to the UBO (name, date of birth, place of residence, etc.). (transparenzregister.de)
In practice, the Chambers of Industry and Commerce also explain the reporting obligations to the transparency register and the more active reporting approach following the abolition of the “mitteilungsfiktion”. (Industrie- und Handelskammer)

The takeaway for the investor: The more complex your ownership structure (holding chain, multi-tiered ownership, nominee-like structures), the greater the need for UBO detection and documentation. Complexity can raise the bank's risk score and trigger "enhanced due diligence."

5) “High risk” triggers in AML/KYC: Under what circumstances does the bank shift gears?

Article 15 of the GwG (General Wage Law ) regulates the “verstärkte Sorgfaltspflichten” ( enhanced diligence regime) ( Gesetze im Internet )
In practice, this regime entails a range of consequences, including more documentation, more in-depth questioning, longer waiting times, and sometimes even a decision to “reject/close an account.”

5.1. PEP (Politically Exposed Person) – risk of contact with politics

Politically exposed persons (PEPs) and their close contacts/associated individuals are a classic high-risk category in AML. The FIU (Zoll) information sheets explain the PEP concept with reference to GwG (zoll.de)

Practical advice for investors: Whether or not you are a PEP (Protected Economic Operator) should not be perceived as being solely "active duty" personnel. Banks often also investigate family ties and close relationships.

5.2. High-risk countries / cross-border fund flows

The country of origin of the funds is a key input for banks' risk model. Additional documentation is required for some countries; in some cases, you are expected to write a more detailed explanation of "the purpose of the transfer + the economic rationale.".

5.3. Crypto assets

Because the “document standard” for crypto assets is more difficult in traditional banking, crypto sources are more frequently on the radar of banks. Increased due diligence regarding crypto transfers is also regulated in the GwG (§15a). (Gesetze im Internet)

Practical file approach: If a crypto source is available, exchange statements, transaction hashes, fiat conversion records, tax declaration/explanation, and the "initial acquisition" story should be prepared together.

6) How to prove the "source of the money"? (Checklist for SoF file)

The bank's goal is to monitor the flow of money seamlessly and efficiently . For this, a single document is often insufficient; a chain of documents is required.

6.1. Most commonly accepted SoF document sets (examples)

The following examples are typical scenarios; in this specific case, the bank may request additional documents:

(A) Salary/Wage income and savings

Employment contract + payslips
Bank statement (showing savings)
Tax return/summary

(B) Company profit / dividend

The company's financial statements (audited if possible)
Dividend decisions + payment receipts
Tax summaries for the relevant period

(C) Sale of real estate

Sales contract / title transfer documents
Receipt showing the payment of the sale price to the account
Valuation report, if any

(D) Inheritance

Certificate of inheritance / document of heirship
Inheritance distribution document
Bank records showing inflow of money from inheritance

(E) Credit / borrowing

Loan agreement + payment plan
Lender's SoF/SoW explanation (especially in private peer-to-peer loans)
Money transfer flow

6.2. Why are “cash” and “hand-to-hand” resources problematic?

In cash-intensive sources, the documentation trail is weak. The risk for the bank is the loss of "traceability." Therefore, in cash-based investments, either extensive additional proof is required, or the bank may not accept the transaction.

7) Suspicious Transaction Reporting (STR) and FIU/goAML: Bank's "reporting" obligation

The most sensitive aspect of AML/KYC for investors is this: sometimes, when a bank requests documents, a suspicious transaction .

7.1. Notification obligation: GwG §43

Article 43 of the GwG (General Written Law) regulates the notification of suspicious circumstances for those obligated to comply. (Gesetze im Internet)

7.2. Notification channel: electronic notification and goAML (GwG §45)

Notifications are, as a rule, made electronically, and the obligation of those subject to registration in the system is addressed within the framework of §45 (Gesetze im Internet)
The goAML portal of the German FIU explicitly states that notification to the FIU will be made when the conditions of §§43–44 are met, and that this will be carried out via goAML (goaml.fiu.bund.de)

Zoll's FIU pages also emphasize that suspicious activity reporting will primarily be done electronically. (zoll.de)

7.3. Current practical note: 2FA/OTP in goAML

Two-factor authentication with OTP will be activated for goAML Web starting September 1, 2025 (goaml.fiu.bund.de)
This demonstrates that technical preparedness, especially in the event of a "notification required" situation, is also part of AML compliance.

7.4. 2026 technical announcements

Technical notes regarding the electronic submission of notifications within the framework of GwG MeldV can be published on the FIU (Zoll) website (zoll.de)

8) Typical AML/KYC “red flags” for investors

The following patterns frequently generate “alarm” signals in the risk models of German banks:

A single large, unexplained transfer (especially to a newly opened account)
High frequency input/output (suspected round-tripping)
Payments with weak billing/business relationship logic (insufficient transaction description)
UBO structure is unclear/multilayered (transparency issue)
with PEP connection or public revenue (zoll.de)
Crypto-based funds (especially from self-hosted wallets) (Gesetze im Internet)
Cash-intensive sectors (lack of documentation of cash inflows)

These red flags do not mean "crime"; however, they may trigger the bank's enhanced due diligence procedures and request further documentation. (Gesetze im Internet)

9) How to prepare a "compliance pack" for those investing in Germany?

Preparing a file in the following format before the transaction can save significant time in practice, allowing you to provide quick and consistent answers to the bank's questions:

9.1. Two-page “background story” (SoF Memo)

Investment amount, currency, date range
Source of funds (e.g., company profits + real estate sales)
Cash flow (Account A → Account B → German bank account)
The economic logic of the matter (why Germany, which project, which expenses)
Expected trading volume (monthly inflow-outflow forecast)

9.2. Document attachments (chain logic)

At least 1 main document + 1 supporting document for each claim
Document naming conventions: For example, “01_SaleContract.pdf, 02_BankStatement_March.pdf”
For foreign documents (documents from Türkiye), a sworn translation and apostille are recommended if possible

9.3. Corporate structure diagram (UBO Map)

The company's structure, share percentages, and control relationships
UBO credentials + Transparenzregister compatibility (registration/screenshot approach if applicable) (transparenzregister.de)

10) How should you respond if the bank requests additional documents?

Instead of a single "yes/no" answer, provide a structured response:
"This fund is income Y from the sale of X. Contract Appendix 1, account entry Appendix 2, tax return Appendix 3."
Do not leave the description fields blank:
Elements such as the transfer description, invoice reference, and contract number increase traceability.
Avoid unnecessary complexity:
Scheduling a single transfer through seven different accounts increases the risk score unless a "economic justification" is provided.

11) Personal data and privacy: “Do I have to provide all these documents?”

Banks process significant amounts of personal data under AML/KYC regulations. The FIU's analysis of suspicious reports is also related to the processing of personal data, and this is a matter of concern for data protection authorities (bfdi.bund.de)
The practical reality for investors is this: the bank may insist on requesting certain data due to its obligations under GwG, and you may have to manage these requests to maintain the account relationship.

12) Conclusion: In Germany, the prerequisite for investment is "not money, but explainable money."

In Germany, AML/KYC in investment processes is not "bureaucracy that slows things down"; it is a risk management mechanism that banks are obliged to implement within the framework of GwG. Banks operate under the obligations of customer identification, UBO determination, and relationship monitoring within the scope of §10 ; increased diligence under §15 comes into play when the risk increases ( Gesetze im Internet ). If a suspicious situation arises, the notification regime under §43 and the goAML/FIU infrastructure may come into play; electronic notification and the goAML registration system are related to §45 ( Gesetze im Internet )

Therefore, the most accurate strategy is this: Prepare the "SoF file" simultaneously with your investment decision. If you establish the source of the fund, the flow of money, the transparency of the UBO (Universal Business Initiative), and the transaction logic from the outset, opening a bank account and transferring capital will proceed with much less friction.

Law Articles