Financial Crime in Payments

Financial crime in payments covers two related but distinct problems. Fraud is a payment the account holder did not want, or wanted only because someone deceived them; the joint EBA and ECB report on payment fraud puts reported fraud across the EEA at EUR 4.2 billion in its latest full year. Money laundering is the separate act of moving the proceeds of crime through the financial system to make them look legitimate, and it often uses the same accounts and rails that a fraud victim's money passes through, for example a mule account that receives stolen funds and forwards them on within hours. A payment institution's financial crime program has to catch both: the transaction that should never have been authorized, and the transaction that looks clean but carries dirty money.

Today a German payment institution's anti-money laundering duties stand in the Geldwäschegesetz (GwG), which transposes an EU directive. The EU has now adopted Regulation (EU) 2024/1624, the Anti-Money Laundering Regulation (AMLR), a single rulebook that applies directly in every member state from July 10, 2027, replacing the patchwork of national transpositions. Alongside it, a sixth AML directive sets minimum standards member states still transpose into national law, including a 25 percent-or-more threshold for identifying a beneficial owner.

The new EU Anti-Money Laundering Authority, AMLA, has its seat in Frankfurt am Main and became operational on July 1, 2025. AMLA can fine a firm up to EUR 10 million or 10 percent of annual group turnover, whichever is higher, for the most serious violations, and from 2027 it will start selecting the first group of large, cross-border credit and financial institutions for direct supervision, working alongside national supervisors such as BaFin. For a payment institution licensed in Germany, financial crime compliance now means planning for BaFin oversight today and AMLA oversight, or at least AMLA-set standards, from 2027.

Since the EU's instant payments rule took effect, a payment service provider in the euro area must screen its customers against EU sanctions lists at least once a day, not only at the moment a transfer goes out. The daily check catches a customer added to a sanctions list overnight, before that customer makes the next payment. Screening sits next to know your customer duties as one of the standing obligations a payment institution or bank carries for as long as it holds an account, not only when the account opens. See KYC in Germany for how identity checks and beneficial-owner screening work at onboarding.

Section 2 of the GwG lists 16 groups of obliged entities in Germany, among them payment and e-money institutions, banks, crypto-asset service providers, life insurers and asset managers. Each one needs a designated anti-money laundering officer, a written risk assessment, staff training and a way to report suspicious transactions to the Financial Intelligence Unit, the German authority that receives and analyzes these reports. A fintech that only initiates payments still falls under these duties once it holds a payment institution license, even if it never custodies customer funds overnight.

Finance Loop is the meeting place for the compliance officers, fraud analysts and payments teams who work on financial crime day to day. It connects the finance, IT and AI communities in Germany, Austria and Switzerland, with events in Frankfurt, Munich, Berlin and Hamburg.

Finance Loop supports When Banks Say 'No', a payments seminar at the NEXTOWER in Frankfurt for compliance, treasury and legal teams, where Dr. Julia Pfeil of Dentons speaks on payments governed by sanctions and anti-money laundering law and Albert Quehenberger of A|Q FORENSICS shows how blockchain forensics traces crypto flows in financial crime cases. KI Exchange 2026 in Hamburg, a conference by Payment & Banking on AI in banking and fintech, had fraud detection and DORA compliance on its program. Related pages: KYC in Germany, fraud prevention in Germany and payments in Germany.

Financial crime in payments covers fraud, where a payment is made without the account holder's real consent or through deception, and money laundering, where criminal proceeds move through legitimate-looking transactions to hide their origin. A payment institution's financial crime program addresses both, since the same account and the same transfer can carry either risk.

AMLA, the EU's new Anti-Money Laundering Authority seated in Frankfurt, will directly supervise a group of large, cross-border financial institutions from 2027 and coordinate national supervisors such as BaFin for the rest. It can impose fines of up to EUR 10 million or 10 percent of annual group turnover for the most serious breaches, and it works alongside the directly applicable AML Regulation that replaces today's directive-based national laws.

Under the EU's instant payments rule, a payment service provider in the euro area screens its customers against EU sanctions lists at least once a day, in addition to any checks run at the moment of a transfer. The daily cycle is meant to catch a name added to a sanctions list between transactions, not only at the point of payment.