Our employees only speak German in the office and on the phone.

Show commissioning of third parties with internal security measures

  • Recht und Verbraucherschutz
  • Verbraucherschutz, Compliance und Recht

Are you an obliged entity within the meaning of the Money Laundering Act and wish to transfer business and/or customer-related internal security measures to an external third party? Then you are obliged to notify the competent supervisory authority accordingly.

  • Basic information

    As an obligated party under money laundering law, you must create appropriate business and customer-related internal security measures to manage and mitigate the risks of money laundering and terrorist financing through suitable policies, procedures and controls.

    You can also transfer the implementation of internal security measures to third parties within the framework of contractual agreements. However, you must first notify the competent supervisory authority of the intended outsourcing. The Money Laundering Act contains standard examples of the security measures to be put in place. This list is not exhaustive. Further internal security measures may be required in individual cases. The internal security measures still require the approval of the member of your company's management responsible for money laundering prevention.

    As an obliged entity, you may have the internal security measures carried out by an (external) third party within the framework of contractual agreements if you have notified the supervisory authority in advance. The supervisory authority may prohibit the transfer if

    • they do not offer a guarantee that the security measures will be carried out properly.
    • the control options of the obligated party are impaired or
    • the supervision by the supervisory authority is impaired.

    For you as the obliged entity, this means that you must demonstrate in your notification that the conditions for prohibiting the transfer are not met.

    You must also state in the notification which internal security measures are the subject of the outsourcing

    The notification must be made by the obliged entity itself or, if applicable, by the appointed money laundering officer.

    Important note:

    The responsibility for the fulfillment of the internal security measures remains with the obliged entities. If, for example, the third party does not properly fulfill the contractually assigned obligations, you remain responsible for non-compliance with the internal security measures.

    Requirements

    • Obligated parties under the Money Laundering Act
      • Only natural or legal persons who are obligated parties under the Money Laundering Act (GwG) are entitled to report money laundering.
      • The person making the report must be a member of management or an internal/external money laundering officer of the company.
    • The third person must be responsible for implementing the internal security measures:
      • be sufficiently qualified and reliable, provide assurance that the safeguards are properly implemented and
      • the outsourcing must not impair the control options of the obligated party or the supervision of the supervisory authority.

  • Procedure
    • The report must be submitted to the competent supervisory authority by the obliged person himself or, if applicable, by the appointed money laundering officer
    • Your report will be reviewed by the competent authority
    • You will receive a final notification
    • After notification, the internal security measures can be carried out by a third party
    • prior approval by the authority is not required.
    • The supervisory authority may prohibit the transfer to a third party if
      • the third party does not guarantee that the security measures will be carried out properly,
      • the control options of the obligated party are impaired as a result, or
      • supervision by the supervisory authority is impaired

  • Necessary Documents
    • Notification of the outsourcing of internal security measures:
      • The notification must clearly state which internal security measures are the subject of the outsourcing.
      • In addition, the notification of outsourcing must state in full and in writing that all requirements have been met and that there are no grounds for prohibiting the intended outsourcing.
    • Proof of authorization to display:
      • Proof of appointment as money laundering officer or
      • Contract on the outsourcing of internal security measures or
      • Proof that the reporting person is a member of the company's management (e.g. extract from the commercial register or shareholders' agreement)
    • Contract with the third party:
      • Copy of the contractual agreement with the third party to whom the security measures are to be outsourced.
    • Current excerpt from the commercial register, if applicable
      • Registered companies should submit a current excerpt from the commercial register with the advertisement. Legal entities in the process of being founded (GmbH, AG) must submit the articles of association or articles of incorporation.
      • Please note: The authority may request proof of the service provider's suitability - this could be, for example, CVs, training certificates or references that explicitly refer to money laundering obligations and experience.

  • Competent Department

  • Fees / Costs

    79,31 EUR bis 1.110,34 EUR Within the remit of the Senator for Economic Affairs, Ports and Transformation and the City of Bremerhaven.
    5,00 EUR bis 500,00 EUR Within the remit of the Senator for Home Affairs and Sport.

  • Deadlines & processing time

    What deadlines must be paid attention to?

    Notification of the outsourcing of internal security measures must be made prior to the outsourcing.
    After notification, the internal security measures can be implemented; prior approval by the authority is not required.

    How long does it take to process

    2 weeks bis 4 weeks

  • Legal Bases

Feedback on quality

Your feedback will help us to identify and solve problems. You will not receive a personal response. Please do not submit any personal data.

Did you find what you were looking for?
How do you rate this page?*
*Mandatory field

This page has been automatically translated by DeepL. We cannot guarantee that the translation is correct.

The official information in German is complete and correct. 24.04.2026

Dienstleistungen · syfq nzm