Anti-Money Laundering Act: The Duties That Affect Small Businesses Too

Why anti-money laundering law does not only concern banks

A new customer wants to pay 14,000 euros in cash for a machine. Another asks for the invoice to be addressed to a company abroad, while the money comes from a third company. A third makes a down payment, cancels the order, and wants the refund sent to a different account. In each of these cases, a question arises that many owners notice only when it is too late: do I have to check, document, or report something here?

The question this article sets out to answer: Which anti-money laundering duties apply to a small or medium-sized business, and how can it meet them with reasonable effort? To answer it, we first clarify the terms, then the group of obliged entities and the duties that affect almost everyone. Then follow a thinking model for classifying business partners, two perspectives on the benefit of the rules, and an outlook on the changes from 2027.

What is money laundering, and who is a beneficial owner?

Money laundering means bringing money from criminal offenses into the legal economy in such a way that its origin remains hidden. The literature describes three phases. In placement, the money enters the financial system, for example as a cash deposit or cash purchase. In layering, it is moved through many transactions until the trail is unclear. In integration, it returns as apparently clean assets, for example as a stake in a company or real estate.

For a business, the first two phases are the dangerous ones. A cash purchase of high-value goods is typical placement. Payments via third parties, unusual cancellations, and refunds to other people's accounts are typical layering. The business does not become the perpetrator, but it becomes the tool.

A second term recurs throughout the law. The beneficial owner is the natural person who ultimately owns or controls a company, usually with more than 25 percent of the shares or voting rights. Behind a limited company owned by another limited company, there is always a person in the end. Knowing that person is at the heart of many duties.

Who is obliged under the Anti-Money Laundering Act?

Section 2 of Germany's Anti-Money Laundering Act (GwG) lists the obliged entities. Besides banks, payment service providers, insurers, and crypto service providers, they include several groups that are common among small and mid-sized firms. For them, however, the duties start at different points.

The term trader in goods is broad. It covers not only the jeweler or car dealer, but in principle every business that sells goods commercially. If you never accept cash in that amount, however, you have little to do as a trader in goods. If you do, you must identify the customer, establish the beneficial owner, keep the records, and set up risk management. Supervision of the non-financial sector lies with Germany's federal states, usually with regional government authorities. Some authorities have extended the duties by general order.

Which duties affect almost every business?

Three duties also affect businesses that have never considered themselves obliged entities.

• Transparency register: Since August 1, 2021, all legal persons under private law and registered partnerships, including every limited company (GmbH), must actively report their beneficial owners to the transparency register. The former reference to the commercial register is no longer sufficient. Changes among shareholders must be reported.
• Reckless money laundering: Section 261 of the German Criminal Code punishes not only intentional but also reckless money laundering. Acting recklessly means grossly overlooking what should have been obvious to anyone. This applies to everyone, not only to obliged entities.
• Reporting suspicion: Obliged entities must report facts indicating money laundering without delay to the Financial Intelligence Unit (FIU) at German customs, regardless of the amount. Informing the customer about it is prohibited.

The FIU's annual report shows how much is actually reported. The number of suspicious activity reports fell in 2024, and the share of the non-financial sector remains very small.

The small share of the non-financial sector has been criticized for years, because cash transactions, real estate, and high-value goods are considered particularly vulnerable. For businesses, this means: supervisors are looking more closely, and a missing report is hard to explain with ignorance.

The thinking model: the three-factor matrix for business partners

Anti-money laundering law follows the risk-based approach: not every customer is checked with the same thoroughness, but according to risk. That sounds reasonable, but in practice it leaves a lot of room for gut feeling. Luchkov and Velinova-Sokolova (2026) developed a simple grid for this, the three-factor matrix. It rates every business partner on three axes with a value from 1 to 5 each and multiplies the values.

The multiplication has a reason: a high value on one axis is dampened by low values on the others, whereas several high values together produce a clear signal. The authors tested the model in 2026 on 25 anonymized profiles. They themselves emphasize that it does not detect money laundering and was not validated against actual cases. Its benefit lies elsewhere: the same facts lead to the same classification, and the decision can be traced later.

An everyday analogy: a doorman does not make everyone wait the same amount of time. He looks at who is coming, how someone behaves, and whether they can show identification. Only when several things do not fit does he ask more closely. The matrix turns this look into a fixed procedure that can be written down.

Bureaucracy or protection? Two perspectives

There are weighty voices for the first perspective. In the very title of his paper, Pol (2020) asks whether anti-money laundering is the world's least effective policy experiment, and criticizes that it developed separately from the principles of good policy design. Lapteș (2024) notes that compliance costs, especially for banks, clearly exceed the sums recovered by authorities, and that reliable data on the extent of money laundering is lacking.

The second perspective is supported by the fact that most checks belong to good business practice anyway. A partner whose owners are unclear and who wants to pay in cash is not only a money laundering risk, but also a default and fraud risk. Business partner due diligence describes how to check partners in general.

I consider both perspectives correct, but on different levels. Whether the system as a whole is effective is a political question. Whether your own business unknowingly becomes a tool is an entrepreneurial one. The owner can answer the second question himself, with little effort.

If you do not know your customers, you sell not only goods but also the opportunity to launder money.

What changes from 2027?

In 2024, the EU adopted a package against money laundering. Kaiser (2024) describes its four parts: a directly applicable regulation with uniform duties for companies, a directive for authorities, a new European supervisory authority based in Frankfurt, and rules for tracing crypto transfers. For businesses, the regulation is the most important part.

1. August 1, 2021

   The transparency register becomes a full register. All companies must report their beneficial owners themselves.

2. 2024

   The EU adopts Anti-Money Laundering Regulation (EU) 2024/1624, the directive, and the regulation establishing the new authority AMLA.

3. July 10, 2027

   The regulation applies directly. Cash payments above 10,000 euros are prohibited in commercial trade and services throughout the EU. Stricter national limits may remain.

4. From July 10, 2027

   According to experts, traders in goods largely drop out of the group of obliged entities. Those that remain obliged include dealers in precious metals and stones, in certain luxury goods such as watches over 10,000 euros and vehicles over 250,000 euros, and in cultural goods from 10,000 euros.

For most businesses, this makes things simpler, not stricter: if you may no longer accept cash payments above 10,000 euros, you do not need due diligence duties for them either. Obliged entities, however, will in future also have to check their suppliers, not only their customers. How Germany will adapt its own law had not been finally settled as of November 2026. You should keep an eye on this point.

How to meet the duties with little effort

For a business outside the financial sector, a lean procedure is enough. It takes one afternoon once and then a few minutes per unusual case.

1. Clarify your own position

   Check whether your business belongs to a group of obliged entities and whether you accept cash of 10,000 euros or more, or 2,000 euros or more for precious metals. If in doubt, ask your chamber of commerce.

2. Check the transparency register

   Verify that your company is registered with its current beneficial owners. This also applies if you are not an obliged entity.

3. Set a cash rule

   Define in writing up to which amount cash is accepted. Many businesses set the limit well below 10,000 euros and thus spare themselves the due diligence duties.

4. Classify the unusual

   Rate new partners with unusual payment requests using the three-factor matrix and record the result.

5. Name a responsible person

   Designate someone who decides, in case of doubt, whether to seek advice or report. Whistleblower protection describes how concerns reach the right place in a business.

Particular caution applies to payments in crypto-assets, because the origin and route of the funds are hard to check. Accepting crypto payments in business covers this, and Custody of crypto-assets in a company deals with safekeeping. Corporate governance for small businesses shows how a small business organizes controls of this kind overall.

Conclusion: which duties really affect small businesses?

To the guiding question: most small businesses are not obliged entities with extensive due diligence duties, as long as they do not accept large cash amounts and do not operate in special sectors such as real estate, art, or precious metals. Three things, however, apply to almost everyone: registration in the transparency register, the criminal liability for reckless money laundering, and, for obliged entities, the duty to report suspicion. From July 2027, the EU regulation sets a uniform cash limit and reduces the group of obliged traders.

Whether anti-money laundering law is effective overall remains disputed. For your own business, the answer is simpler: if you know your business partners and classify unusual payments in a traceable way, you protect yourself against criminal liability, defaults, and reputational damage at the same time.

• Clarify whether your business belongs to a group of obliged entities.
• Check your company's entry in the transparency register.
• Set a written cash limit and communicate it to the team.
• Introduce the three-factor matrix for unusual payment requests.
• Name a responsible person for cases of doubt.
• Mark July 10, 2027, in the calendar and check the new situation beforehand.