BaFin AMLA Guidelines: Overview Table Replaces Adoption Circulars

On 1 October 2026 the German Federal Financial Supervisory Authority (BaFin) started publishing a tabular overview of which guidelines issued by the European Supervisory Authorities (ESAs) and by the EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) it has adopted into its administrative practice, and which it has not. In the same notice BaFin said it will no longer publish, or consult on, circulars that merely state whether a guideline has been adopted. For AML teams tracking BaFin AMLA guidelines and the EBA AML/CFT guidelines that still apply in Germany, the record of BaFin’s position now sits in a spreadsheet row, supported by short website notices and newsletter items.

The change affects where a German compliance or reporting team finds, cites and evidences BaFin’s stance on a European guideline; the substantive due diligence and suspicious transaction reporting rules stay as they were. The table also carries more than a one-line adoption circular did: a status column that separates full, partial and pending adoption, and a remarks column where BaFin records its carve-outs. Under the notice, BaFin’s decision on the first AMLA guidelines will be recorded there too, without the adoption-only circular and consultation that used to precede it.

Related reading: EU AML package guide: AMLR, AMLD6 and AMLA

Key dates around BaFin’s switch to an overview table

• 1 January 2026: the EBA and AMLA complete the transfer of all AML/CFT mandates and functions from the EBA to AMLA. The EBA’s news item of 19 January 2026 states that existing EBA AML/CFT guidelines and standards remain in force until AMLA replaces them.
• 10 July 2026: the date by which Article 10(4) of Regulation (EU) 2024/1624 (AMLR) required AMLA to issue guidelines on the business-wide risk assessment.
• 2 September 2026: the status date (“Stand”) printed on the AMLA sheet of BaFin’s file. The sheet lists no AMLA guideline.
• 28 September 2026: the status date of the EBA sheet, which holds every AML/CFT guideline row in the file.
• 1 October 2026: BaFin’s overview goes live and the German notice is published. Adoption-only circulars and their consultations stop with immediate effect.
• 5 October 2026: BaFin publishes the English version of the notice.

Two sentences that change BaFin’s publication routine

The notice is short. BaFin now shows on its website, in tabular form, which ESA and AMLA guidelines it has taken into its administrative practice and which it has not. It adds that it informs about this in a short notice on its website and in its newsletter. BaFin will also no longer publish or consult on circulars that merely indicate whether a guideline has been adopted, and it gives the reason itself: fewer publications on administrative practice and less bureaucracy.

The overview is an Excel download dated 1 October 2026, linked from BaFin’s page on ESA and AMLA guidelines and Q&As. That page also links a separate list of ESA Q&As that BaFin has not adopted, or has adopted only in part.

The word that scopes the change is “merely”. BaFin’s AML circulars that carry their own content appear to sit outside that description. Rundschreiben 07/2026 (GW) of 13 July 2026, on third countries with strategic deficiencies in their AML/CFT systems, is the most recent example on BaFin’s AML administrative-practice page. The notice says nothing about the adoption circulars BaFin issued before 1 October, and it does not say whether they will be withdrawn or simply left in place. That gap matters for any policy document whose applicability section cites a circular number as proof that a guideline applies in Germany.

Comply-or-explain under Article 16 of the ESA Regulations and Article 54 AMLAR

The legal mechanics sit at EU level. Article 16(3) of Regulation (EU) No 1093/2010, the EBA Regulation, says competent authorities and financial institutions shall make every effort to comply with the EBA’s guidelines. Within two months of issuance, each competent authority confirms whether it complies or intends to comply; if it does not, it informs the EBA and gives reasons. The EBA publishes the fact of non-compliance and may publish the reasons. The same paragraph adds a firm-level duty that is easy to miss: if the guideline requires it, financial institutions report, in a clear and detailed way, whether they comply.

Article 54 of Regulation (EU) 2024/1620 (AMLAR) copies that structure for AMLA. Its guidelines may be addressed to supervisory authorities, supervisors, financial intelligence units (FIUs) or obliged entities. Article 54(3) requires all four groups to make every effort to comply. Supervisory authorities, supervisors and FIUs confirm within two months whether they comply or intend to comply, or inform AMLA of their reasons if they do not, and obliged entities report on their own compliance where the guideline requires it. Article 54(2) requires AMLA to run open public consultations where appropriate, and to publish its reasons when it does not consult.

BaFin’s own page frames the effect from the German side. It describes ESA and AMLA guidelines and Q&As as legally non-binding in themselves, taking effect once BaFin adopts them into its administrative practice. For guidelines BaFin uses the comply-or-explain procedure and declares compliance to the European authority. For Q&As it decides informally, and no German translation is needed. BaFin says it generally aims to adopt both, and that non-adoption has mainly occurred where features specific to German supervisory or resolution law stood in the way.

Those two framings sit side by side. The EU texts direct the “every effort” duty at institutions and obliged entities as well as at supervisors; BaFin describes the practical effect in Germany as starting with its own adoption. An internal policy that cites only the EU guideline relies on the first; one that also cites BaFin’s table entry documents the supervisor’s position. A file that carries both references covers both readings.

The two-month clock has a practical wrinkle. ESA guidelines can set the notification deadline by reference to their translations: the joint ESA guidelines JC/GL/2024/36, for example, require authorities to notify within two months of the issuance of the translated versions. BaFin’s file shows the effect. Its publication-date column (“Veröffentlichungsdatum”) gives 11 February 2025 for the two EBA restrictive-measures guidelines, while the EBA published the final report on 14 November 2024 and set a compliance notification deadline of 11 April 2025. My reading is that the column tracks the translated release, so it should not be copied into a register as the EBA’s issuance date.

Reading the BaFin AMLA guidelines file: sheets, status codes and remarks

The workbook has five sheets: AMLA, EBA, EIOPA, ESMA and the ESAs’ joint guidelines. Each carries its own status date, so one download can mix currencies: 2 September 2026 for AMLA, 18 September for joint guidelines, 21 September for EIOPA, 22 September for ESMA and 28 September for the EBA. Every sheet uses the same eight columns: year, reference number, title, related directive or regulation, publication date, application date, adoption into BaFin’s administrative practice, and remarks (“Hinweise”).

The adoption column uses the ESA compliance vocabulary: compliant, intend to comply, partially non-compliant and non-compliant. In the 1 October file, the EBA sheet holds 155 entries: 138 compliant, 13 partially non-compliant, 3 intend to comply and 1 non-compliant. Neither the ESMA nor the EIOPA sheet contains an AML/CFT guideline, and none of the 12 joint-guideline rows is an AML/CFT instrument. For German AML purposes the EBA sheet is the live one today, with the AMLA sheet waiting for its first row.

“Intend to comply” rows explain themselves in the remarks. For EBA/GL/2025/03 on ADC exposures, for example, BaFin notes that the guidelines are not yet applied because national implementing measures are still in progress. That status therefore describes a future position and should not be booked as current practice.

The related-act column is where a quick filter goes wrong. These are the AML/CFT-relevant rows on the EBA sheet, with the act BaFin names for each:

Filter the related-act column on the Anti-Money Laundering Directive and five of these twelve rows drop out, including the travel rule guidelines and both restrictive-measures guidelines.

The remarks column also handles amendments unevenly. The row for EBA/GL/2021/02 notes that it was amended by EBA/GL/2023/03, while EBA/GL/2024/01, whose own title says it amends EBA/GL/2021/02, appears only as a separate row. Where BaFin has recorded a replacement, the remark says so (“Ersetzt durch”). The row for the product oversight and governance guidelines EBA/GL/2015/18 carries that remark for EBA/GL/2026/07, although the EBA’s final report of 30 June 2026 describes EBA/GL/2026/07 as amending guidelines that apply from 11 January 2027. The download link itself carries a version parameter (v=13 on the copy retrieved for this article on 6 October 2026), and the download page links one current file.

Partial adoption: the restrictive-measures guidelines and their carve-outs

The two rows that are not marked compliant matter most to a sanctions-screening owner. The EBA issued both sets on 14 November 2024, and both apply from 30 December 2025. EBA/GL/2024/14 is addressed to all institutions within the EBA’s supervisory remit and deals with the governance and risk management arrangements needed to address the risk of breaching or evading restrictive measures. EBA/GL/2024/15 is addressed to payment service providers (PSPs) and crypto-asset service providers (CASPs) and sets out what they should do to comply with restrictive measures when performing transfers of funds or crypto-assets.

BaFin marks both as partially non-compliant. In my translation of its remarks:

• EBA/GL/2024/15: BaFin implements the guidelines except the requirements on intraday screening of domestic transfers and on assigning monitoring tasks to the national supervisory authority (BaFin), because by law the Deutsche Bundesbank is responsible for these tasks.
• EBA/GL/2024/14: BaFin implements the parts of the guidelines covered by the German Banking Act (KWG) as regards proper business organisation and by the Foreign Trade and Payments Act (AWG) as regards monitoring compliance with restrictive measures.

A screening procedure that cites EBA/GL/2024/15 as adopted by BaFin, without those two carve-outs, records more than BaFin adopted. The same applies to an internal control framework that maps EBA/GL/2024/14 paragraph by paragraph and treats every paragraph as part of BaFin’s practice. For the list-side changes that feed the screening engine, see our EU sanctions screening update on Council Regulations 2026/1708 and 2026/1710.

The EBA keeps compliance tables for both guidelines, last updated on 30 July 2025 for EBA/GL/2024/14 and on 16 February 2026 for EBA/GL/2024/15, which record each national authority’s notification. BaFin’s remark names the Bundesbank as responsible for the carved-out tasks, but the file does not say what applies in place of the excluded paragraphs.

An empty AMLA sheet and the EBA guidelines that still apply

Article 54(5) AMLAR sets the hand-over rule. AMLA guidelines replace guidelines previously issued by the EBA, or by supervisors and FIUs, on the same subject. Until AMLA’s guidelines on a subject start to apply, the EBA guidelines issued under Directive (EU) 2015/849 and Regulation (EU) 2023/1113 remain applicable, provided they are still relevant, and AMLA is to provide a suitable transition period. The EBA said the same in plainer words in January 2026: its existing AML/CFT guidelines and standards remain in force until AMLA replaces them.

AMLA’s regulatory-instruments page lists the EBA guidelines that continue to apply under Article 54(5): the risk factors guidelines, remote customer onboarding, internal policies for restrictive measures, the travel rule guidelines, the compliance officer guidelines, the de-risking guidelines, the risk-based supervision guidelines and the joint ESA guidelines on AML/CFT colleges. The EBA rows in BaFin’s file therefore remain the operative German record for AML/CFT guidelines, and a team that archives them as legacy EBA material after the handover loses its current evidence of BaFin’s position.

One mismatch is worth flagging. The AML/CFT colleges guidelines appear on AMLA’s continuing list, yet BaFin’s joint-guidelines sheet has no row for them, and the file does not explain the absence.

The AMLA sheet will fill as AMLA finalises guidelines. Its regulatory-instruments page shows two sets of draft guidelines with consultations closed: ongoing monitoring of business relationships under Article 26(5) AMLR, and the business-wide risk assessment under Article 10(4) AMLR. Article 10(4) gave AMLA until 10 July 2026 for the latter. When checked for this article on 6 October 2026, neither was shown with final status.

Guidelines only: what BaFin’s table will never list

The overview covers guidelines, and BaFin’s separate list covers ESA Q&As it has not adopted. Technical standards follow a different route. Regulatory technical standards mandated by the AML package are developed by AMLA and submitted to the European Commission for adoption under the procedure in Articles 49 to 52 of Regulation (EU) 2024/1620. Implementing technical standards follow the separate procedure in Article 53; Article 53(4) provides that they are adopted as regulations or decisions, published in the Official Journal and enter into force on the date stated in them. They need no BaFin adoption step, so they will not appear in the file.

Several AML instruments with a direct reporting impact sit outside the table. AMLA lists a final report on its draft RTS on customer due diligence under Article 28(1) AMLR, submitted to the Commission and applicable only once adopted and published in the Official Journal (AMLA press release of 1 October 2026), covered in our article on AMLA’s final draft CDD and linked-transactions RTS, and its draft ITS on the format for reporting suspicions and providing transaction records under Article 69(3) AMLR has completed its consultation. The same applies to supervisory-cooperation standards such as AMLA’s RTS on home-host supervisory cooperation. A change register that watches only BaFin’s table would see none of them.

What stays put: Section 43 GwG reports, the AuA and other supervisors

Suspicious transaction reporting runs on its own statutory track. Section 43(1) of the Geldwäschegesetz (GwG) requires obliged entities to report to the Financial Intelligence Unit (Zentralstelle für Finanztransaktionsuntersuchungen) without delay where facts indicate, among other grounds, that assets connected with a business relationship or transaction derive from a criminal act that could be a predicate offence to money laundering, or that a transaction relates to terrorist financing. Nothing in BaFin’s notice touches that obligation, its content or its channel.

BaFin’s interpretation and application guidance (Auslegungs- und Anwendungshinweise, AuA) also continues on its own basis. Section 51(8) GwG requires the supervisory authority to provide obliged entities with regularly updated guidance on implementing due diligence obligations and internal safeguards. The AuA are BaFin’s own text, consulted on separately (Konsultation 06/2024 of 9 July 2024 covered them), and the notice of 1 October addresses circulars on guideline adoption only.

Scope is the third limit. Section 50 GwG makes BaFin the AML supervisor for the financial-sector obliged entities listed in its point 1, assigns insurance undertakings in its point 2 to the competent insurance supervisory authority, and leaves the remaining obliged entities to other authorities. BaFin’s file records BaFin’s administrative practice and nobody else’s. Article 54(3) AMLAR also requires each FIU to confirm for itself whether it complies with a guideline; the German FIU’s confirmation is a separate act from BaFin’s table entry.

Rebuilding the change register around the overview table

For a team whose regulatory-change process was triggered by BaFin circulars and consultations, the 1 October notice removes one input and adds a file to watch. A register built around the new routine would track:

• Sources: the status date on each sheet of the XLSX, BaFin’s short notices and newsletter, and the ESA and AMLA consultation pages, since BaFin no longer consults on adoption-only circulars.
• Evidence: reference number, status, remarks text, sheet status date, file version and retrieval date, with an archived copy of the workbook in place of a circular number.
• Status mapping: compliant rows mapped in full; partially non-compliant rows mapped together with the remarks; intend-to-comply rows held as future items until BaFin changes the status.
• Firm-level reporting: the reporting section of each new AMLA guideline, because Article 54(3) AMLAR lets a guideline require obliged entities to report on their own compliance.

Groups with entities in several Member States face a separate question, because each national authority notifies the EBA separately and the EBA publishes the results in compliance tables. BaFin’s row answers the question only for BaFin-supervised entities.

Frequently Asked Questions

Does a “compliant” row mean every paragraph of the guideline applies to our firm?

It means BaFin has taken the guideline into its administrative practice. Which paragraphs reach a given firm still depends on the addressees and scope set out in the guideline itself. EBA/GL/2024/15, for instance, is addressed to PSPs and CASPs, while EBA/GL/2024/14 is addressed to all institutions within the EBA’s supervisory remit, so the same “compliant” or “partially non-compliant” label can reach different parts of a group.

What happens to adoption circulars BaFin published before 1 October 2026?

The notice is silent on that point and covers future publication and consultation only. Until BaFin states otherwise, a policy that cites an older adoption circular can keep that citation, and adding the matching table entry with its status date points to the record BaFin now maintains.

Will there be any chance to comment before BaFin adopts a new AMLA guideline?

BaFin will no longer consult on adoption-only decisions, so the consultation point moves upstream. Article 54(2) AMLAR requires AMLA to consult where appropriate and to publish its reasons where it does not, which makes AMLA’s consultation, where one is held, the public route for comments on the text of an AMLA guideline.

A future AMLA guideline requires obliged entities to report whether they comply. To whom does that report go?

Article 54(3) AMLAR makes the duty conditional (“If required by that guideline or recommendation”) but does not name the recipient in that paragraph. The guideline’s own reporting section would have to specify it, so the recipient and format should be read from the final text, not assumed from BaFin’s table.

Our group has entities in Germany and Luxembourg. Can the BaFin table stand in for the group?

Only for the entities BaFin supervises. Each competent authority confirms or explains for itself under Article 16(3) of the ESA Regulations, and the EBA publishes national positions in compliance tables. A partially non-compliant row in Germany, such as EBA/GL/2024/15, can sit next to a compliant notification elsewhere, so group policies need the position per supervisor.

Do ESA Q&As appear in the same file?

The workbook lists guidelines only. BaFin keeps a separate list of ESA Q&As that it has not adopted or has adopted only in part, and it decides on Q&As informally, with no German translation required. A team relying on a Q&A would therefore check that list as well as the workbook.

Related Articles

• EU AML Package Guide: AMLR, AMLD6 and AMLA: how the AML Regulation, the sixth AML Directive and AMLA fit together and when each applies.
• AMLA Final Draft RTS on CDD, Linked Transactions and Group-Wide Requirements: AMLA’s final draft standards, which sit outside BaFin’s guidelines table and require Commission adoption before becoming directly applicable.
• AMLA Home-Host Supervisory Cooperation RTS: what supervisors of cross-border groups will share and how.
• AMLA Risk Assessment Data Collection for Direct Supervision: AMLA’s data exercise for selecting directly supervised entities.
• EU Sanctions Screening: Council Regulations 2026/1708 and 2026/1710: list changes that feed restrictive-measures screening.

Key Takeaways

• Cite BaFin’s position on an ESA or AMLA guideline by table row, status, sheet status date and retrieval date; no adoption-only circular will follow.
• Read the remarks before mapping EBA/GL/2024/14 or EBA/GL/2024/15: both are only partly adopted in Germany.
• Do not filter the file on AMLD alone; the travel rule, compliance officer and restrictive-measures rows are filed under other acts.
• Treat the EBA AML/CFT rows as current until AMLA guidelines on the same subject start to apply under Article 54(5) AMLAR.
• Track AMLA RTS and ITS, including the draft ITS on the format for reporting suspicions under Article 69(3) AMLR, outside the table; once adopted as Union acts they apply without BaFin adoption.
• Check each final AMLA guideline for a clause requiring obliged entities to report their own compliance.

Sources and References

• BaFin, ESA and AMLA guidelines: Bafin reduces number of circulars (English notice, 5 October 2026): bafin.de
• BaFin, Leitlinien der ESAs und der AMLA: Bafin reduziert Rundschreiben (German notice, 1 October 2026): bafin.de
• BaFin, Leitlinien und Q&As der ESAs und der AMLA (overview page): bafin.de; English version: bafin.de
• BaFin, Übernommene und nicht übernommene Leitlinien der ESAs und der AMLA (download page, XLSX, 1 October 2026): bafin.de
• BaFin, list of Q&As not or not fully adopted: bafin.de
• BaFin, Verwaltungspraxis Geldwäsche (AML administrative practice page, listing Rundschreiben 07/2026 (GW) and Konsultation 06/2024): bafin.de
• BaFin, Rundschreiben 07/2026 (GW) on third countries with strategic AML/CFT deficiencies (13 July 2026): bafin.de
• Regulation (EU) No 1093/2010 establishing the EBA, Article 16: EUR-Lex
• Regulation (EU) 2024/1620 establishing AMLA (AMLAR), Articles 49 to 54: EUR-Lex
• Regulation (EU) 2024/1624 (AMLR), Article 10(4): EUR-Lex
• Joint ESA Guidelines JC/GL/2024/36 on DORA oversight cooperation (notification within two months of the translated versions): ESMA
• EBA, EBA and AMLA complete handover of AML/CFT mandates (19 January 2026): eba.europa.eu
• EBA, The EBA issues final guidance on internal policies, procedures and controls to ensure the implementation of Union and national sanctions (14 November 2024): eba.europa.eu
• EBA, Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures (EBA/GL/2024/14 and EBA/GL/2024/15, with compliance tables): eba.europa.eu
• EBA, Final report on the amending Guidelines on product oversight and governance arrangements for retail banking products (EBA/GL/2026/07, 30 June 2026): eba.europa.eu
• AMLA, Regulatory instruments (continuing EBA guidelines, draft guidelines under Articles 10(4) and 26(5) AMLR, RTS under Article 28(1) AMLR and ITS under Article 69(3) AMLR): amla.europa.eu
• AMLA, Press release: AMLA finalises key standards for the private sector (1 October 2026): amla.europa.eu
• Geldwäschegesetz (GwG), Section 43: gesetze-im-internet.de
• Geldwäschegesetz (GwG), Section 50: gesetze-im-internet.de
• Geldwäschegesetz (GwG), Section 51: gesetze-im-internet.de

Next checkpoint: the first AMLA row in BaFin’s file

The first test of the new routine will be AMLA’s final guidelines on the business-wide risk assessment or on ongoing monitoring. When either is published, the items to capture are the AMLA sheet’s new status date, BaFin’s status and remarks for the row, the matching BaFin short notice, and the transition period AMLA sets under Article 54(5) AMLAR for replacing the EBA guidelines on the same subject. Until that row exists, the EBA sheet, with status date 28 September 2026 in the 1 October file, is the German record to cite.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.