New BaFin AuA 2025: What obliged entities now need to know and implement
On February 1, 2025, the new Interpretive and Application Guidelines (AuA) for the Money Laundering Act issued by BaFin entered into force. These changes affect obligated companies and institutions involved in combating money laundering and terrorist financing. The new regulations provide greater clarity and standardization, but also entail increased implementation effort.
In this article, we summarize the most important changes, explain their impact on practice, and provide guidance on how those obligated can best prepare for them.
More detailed risk analysis: More sources of information are needed.
Risk analysis remains the central element of anti-money laundering risk management. However, the requirements for identifying and assessing risks are being significantly increased.
Obligated parties must continue to draw on a broader information base. This includes, among other things:
- National and supranational risk analyses,
- Fatf-Standards and recommendations,
- EBA guidelines on risk factors,
- FIU typology papers,
- New: Findings from media analyses and suspected case reports.
One special feature is the Adverse Media Screening : Obligated entities should check whether there are negative media reports about their customers – BaFin already recommended this at the beginning of 2024. However, the new regulations do not impose a formal due diligence obligation.
These changes mean that obligated parties will have to conduct more intensive data research and documentation in order to meet the requirements.
Money laundering and terrorist financing risks must be assessed separately. This is because terrorist financing often uses legal means, while in money laundering the origin of the funds is crucial.
Determining beneficial owners: New clarifications
Politically exposed persons (PEPs) are subject to enhanced due diligence obligations. The new BaFin guidelines specify that obliged entities must ensure that PEP checks are always based on up-to-date lists.
The responsibility for the quality and timeliness of the data used lies directly with the obliged entities. While there is no explicit obligation to use commercial PEP databases, their use is considered an indicator of proper compliance with regulatory requirements.
The demands on service provider management and monitoring are increasing, necessitating closer collaboration with compliance tool providers . With KYCnow, you're on the safe side when it comes to PeP (Personal Expense) verification. We would be happy to provide you with information about our data sources.
Shorter update periods for KYC data
One of the most significant changes concerns the deadlines for data updates:
- Customers with enhanced due diligence obligations: Update at least every 1 year (previously 2 years).
- Customers with general due diligence obligations: Update at least every 5 years (previously 10 years).
- Simplified due diligence: No fixed deadline, but a risk-based assessment is required.
This change entails a significant increase in operational effort, especially for companies with many existing customers. A process automation strategy can provide a solution here.
Even though the BaFin Due Diligence Regulations have been in effect since February 01, 2025, those subject to the new due diligence obligations still have some time to implement them. These regulations will only apply from July 10, 2027.
Documentation and reporting requirements are being tightened.
BaFin reiterates that detailed documentation is essential. Extracts from the commercial register and company lists must not only be up-to-date but also verified to ensure that the information is accurate and reliable.
Obligated parties must demonstrate that they have been in contact with their contractual partners and have validated the information received. Incomplete or incomplete documentation can lead to significant sanctions during an audit, which is why structured and traceable recording of all relevant data is essential.
Automation as the key to efficiency
Given the increasing demands, technology will play a crucial role. Perpetual KYC, or continuous data updates, can help minimize manual processes and make them more efficient.
With our KYC monitoring , we are already one step ahead and offer continuous monitoring of KYC data – both in our KYCnow platform and as direct integration into your systems.
The increased use of artificial intelligence and automation also facilitates the analysis of adverse media screenings by reducing false positives. To efficiently meet regulatory requirements and manage the increasing workload, companies should increasingly rely on digital solutions and modernize their compliance processes accordingly.
Conclusion & Recommendations
The new BaFin guidelines bring both greater clarity and increased implementation effort. Obligated entities should prepare for the new requirements early on.
- Adapt internal processesThe requirements for risk analysis, PEP screening and identification of beneficial owners should be reviewed and optimized.
- Use digital toolsAutomation can significantly reduce the additional effort in the areas of adverse media screening, KYC updates and documentation obligations.
- Training of employeesCompliance teams should be prepared for the new regulations and receive ongoing training.
The full recording of the webinar is available on the SCHUFA Campus and offers further insights as well as practical tips on implementing the new requirements.
Are you interested in an automated, digital KYC solution that meets the requirements of BaFin? Then book your free introductory meeting here now – we look forward to speaking with you.
Lisa Roczniewski