Deutsche Bank AG: Bafin sets new deadlines for remedying shortcomings

Key dates

2021-04-01

BaFin issued an earlier order requiring Deutsche Bank AG to remedy shortcomings in transaction monitoring; the publication gives April 2021 but not an exact day.

2023-11-01

BaFin issued a further order requiring Deutsche Bank AG to remedy transaction-monitoring shortcomings; the publication gives November 2023 but not an exact day.

2026-09-15

BaFin issued the order setting revised deadlines for Deutsche Bank AG’s remediation of transaction-monitoring data-processing deficiencies.

2026-10-06

The BaFin order became final and binding.

2026-10-09

BaFin published the enforcement update.

Suggested considerations

• Deutsche Bank compliance and programme-governance teams should obtain the operative BaFin order and map each revised deadline to the affected transaction-monitoring component, remediation milestone, accountable owner, testing evidence, and supervisory reporting obligation.
• The bank should consider validating that the system reorganisation has not reduced coverage of payment flows, customer and relationship risk indicators, alert generation, case-management records, or escalation and reporting processes during migration.
• Compliance teams should consider documenting how changed technical requirements were translated into revised data models, monitoring scenarios, thresholds, tuning decisions, controls, and model or rule validation outcomes.
• German credit institutions should consider benchmarking their transaction-monitoring governance, data lineage, system change controls, periodic effectiveness testing, and continuous-update processes against the requirements described in sections 25h KWG and 6(2) and 10(1) GwG.
• Firms should consider retaining evidence that suspicious-activity alerts are investigated promptly and that relevant transactions are reported to the FIU where required, including evidence of controls operating during system upgrades or parallel-running arrangements.
• Boards, supervisory boards, and senior managers responsible for AML oversight should consider reviewing whether remediation reporting clearly distinguishes completed corrective actions, residual deficiencies, dependencies, deadline changes, and risks requiring escalation.

What changed

The 2026-09-15 order revises deadlines contained in BaFin’s earlier 2021 and 2023 orders because Deutsche Bank is reorganising its transaction-monitoring system in response to changed technical requirements. The publication does not disclose the revised individual deadlines, identify each remaining deficiency, or impose a new obligation applicable to all institutions. It confirms that credit institutions must operate reliable data-processing systems for identifying suspicious business relationships and payment transactions, continuously update those systems, and use transaction monitoring to support detection and reporting of relevant transactions to the Financial Intelligence Unit. The legal basis is section 51(2) sentence 1 of the German Money Laundering Act (GwG), in conjunction with se

Who is affected

• Deutsche Bank AG
• German credit institutions subject to sections 25h and 25k KWG and the transaction-monitoring duties in the GwG
• EU-authorised banks operating in Germany through branches or subsidiaries where German AML transaction-monitoring requirements apply

Related regulations

• German Money Laundering Act (GwG), sections 6(2) no. 1(e), 10(1) no. 5 and 51(2) sentence 1
• German Banking Act (KWG), section 25h(1)-(5)
• EU Anti-Money Laundering framework
• Directive (EU) 2015/849 (Fourth Anti-Money Laundering Directive), as amended