Regulatory Fine Provisions

(1) It is a regulatory offence for a person intentionally or recklessly to
1. fail to identify or assess risks, contrary to section 5(1), first sentence,
2. fail to document, or regularly review and, where necessary, update, the risk analysis, contrary to section 5(2), nos. 1 and 2,
3. fail to establish appropriate business- and customer-related internal safeguards, contrary to section 6(1), or fail to monitor the functioning of the safeguards, contrary to section 6(1), third sentence, or fail to update business- and customer-related internal safeguards regularly or as needed,
4. fail to operate, or update, data-processing systems, contrary to section 6(4),
5. fail to comply with an enforceable order under section 6(9),
6. fail to record or retain, or fail to do so correctly or completely, a particular, information, results of the examination, grounds, or a comprehensible statement of reasons for the assessment result, contrary to section 8(1) and (2),
7. fail to retain a record or other evidence for five years, contrary to section 8(4), first sentence,
8. fail to establish uniform group-wide arrangements, procedures and measures, contrary to section 9(1), second sentence, including in conjunction with subsection (4),
9. fail to ensure the effective implementation of the group-wide uniform obligations and measures, contrary to section 9(1), third sentence, including in conjunction with subsection (4),
10. fail to ensure, contrary to section 9(2), including in conjunction with subsection (4), that group-affiliated undertakings within the meaning of section 1(16), nos. 2 to 4 located in another Member State of the European Union, that are subject there to obligations to prevent money laundering and terrorist financing, comply with the applicable national provisions implementing Directive (EU) 2015/849,
11. fail to ensure, contrary to section 9(3), second sentence, including in conjunction with subsection (4), that branches and group-affiliated undertakings established in a third country under section 1(16), no. 2 take additional measures to counter effectively the risk of money laundering or terrorist financing, or fail to inform the competent supervisory authority of the measures taken,
12. contravene an enforceable order under section 9(3), third sentence, including in conjunction with subsection (4),
13. fail to implement the measures referred to in subsection (1), second sentence, nos. 1, 3 and 4, contrary to section 9(5), first sentence,
14. fail to implement the measures referred to in subsection (1), second sentence, nos. 3 and 4, contrary to section 9(5), second sentence,
15. fail to identify, or fail to identify correctly, completely or in the prescribed manner, the contracting party or a person acting for the contracting party, or fail to check whether the person acting for the contracting party is authorised to do so, contrary to section 10(1), no. 1,
16. fail to establish whether the contracting party is acting for a beneficial owner, contrary to section 10(1), no. 2,
17. fail to identify the beneficial owner, contrary to section 10(1), no. 2,
18. fail to obtain information on the purpose and intended nature of the business relationship, or fail to assess such information, contrary to section 10(1), no. 3,
19. fail to establish, or fail to establish correctly, whether the contracting party or the beneficial owner is a politically exposed person, a family member, or a person known to be a close associate, contrary to section 10(1), no. 4,
20. fail to continuously monitor, or fail correctly to monitor, the business relationship, including transactions carried out in its course, contrary to section 10(1), no. 5,
21. fail to determine, contrary to section 10(2), first sentence, the specific scope of the general due diligence obligations in accordance with the respective money laundering or terrorist financing risk,
22. fail to demonstrate, contrary to section 10(2), fourth sentence or section 14(1), second sentence, that the scope of the measures taken is appropriate having regard to the money laundering and terrorist financing risks,
23. fail to comply with the due diligence obligations, contrary to section 10(6) or (6a),
24. fail to make a notification, contrary to section 10(8),
25. establish or continue the business relationship, or fail to terminate it, or fail to bring it to an end in some other way, or carry out the transaction, contrary to section 10(9), section 14(3), or section 15(9), in conjunction with section 15(3), nos. 1, 3 and 4,
26. fail to identify in good time the contracting party, a person acting for it, or the beneficial owner, contrary to section 11(1),
27. fail to identify, or fail to identify in good time, the parties to the transaction, persons acting for them, or beneficial owners, contrary to section 11(2),
28. fail to carry out a fresh identification, contrary to section 11(3), second sentence,
29. fail to collect, or fail to collect completely, the particulars, contrary to section 11(4), no. 1 or no. 2,
30. fail to collect the name of the beneficial owner for the purpose of establishing his or her identity, contrary to section 11(5), first sentence,
31. fail to ensure the review of transactions and the monitoring of business relationships, contrary to section 14(2), second sentence, to an extent enabling unusual or suspicious transactions to be identified and reported,
32. fail to fulfil enhanced due diligence obligations, contrary to section 15(2),
33. fail to obtain the consent of a member of senior management before establishing or continuing a business relationship, contrary to section 15(4), first sentence, no. 1, in conjunction with subsection (2) or subsection (3), no. 1,
34. fail to take measures, contrary to section 15(4), first sentence, no. 2, in conjunction with subsection (2) or subsection (3), no. 1,
35. fail to subject the business relationship to enhanced ongoing monitoring, contrary to section 15(4), first sentence, no. 3, in conjunction with subsection (2) or subsection (3), no. 1,
36. fail to obtain information, contrary to section 15(5), no. 1, letters a) to f), in conjunction with subsection (3), no. 2,
37. fail to obtain the consent of a member of senior management, contrary to section 15(5), no. 2, in conjunction with subsection (3), no. 2,
38. fail to subject the business relationship to enhanced monitoring, contrary to section 15(5), no. 3, in conjunction with subsection (3), no. 2,
39. fail to examine the transaction, contrary to section 15(6), no. 1, in conjunction with subsection (3), no. 3,
40. fail to subject the underlying business relationship to enhanced ongoing monitoring, contrary to section 15(6), no. 2, in conjunction with subsection (3), no. 3,
41. fail to obtain sufficient information, contrary to section 15(7), no. 1, in conjunction with subsection (3), no. 4,
42. fail to obtain the consent of a member of senior management, contrary to section 15(7), no. 2, in conjunction with subsection (3), no. 4,
43. fail to establish or document responsibilities, contrary to section 15(7), no. 3, in conjunction with subsection (3), no. 4,
44. fail to take measures, contrary to section 15(7), nos. 4 or 5, in conjunction with subsection (3), no. 4, 44a. fail to take measures for risk identification, risk assessment or risk mitigation, contrary to section 15a,
45. contravene an enforceable order of the supervisory authority, contrary to section 15(5a) and (8),
46. admit a player to gambling, contrary to section 16(2),
47. accept deposits or other repayable funds, contrary to section 16(3),
48. permit transactions of the player to the obliged entity by ways other than those referred to in section 16(4), nos. 1 and 2, contrary to section 16(4),
49. fail to fulfil information obligations, contrary to section 16(5),
50. make transactions to a payment account, contrary to section 16(7), first sentence, no. 2,
51. fail, despite a request by the supervisory authority, to sufficiently specify the purpose of payment, contrary to section 16(7), second sentence,
52. fail to carry out full identification, or fail to do so in good time, contrary to section 16(8), third sentence,
53. have the fulfilment of due diligence obligations carried out by a third party established in a high-risk third country, contrary to section 17(2),
54. fail to obtain, or fail to provide in good time, information, contrary to section 18(3),
55. fail, contrary to section 20(1), to
a) obtain,
b) retain, or retain correctly or completely,
c) keep up to date, or
d) notify correctly, completely or in good time to the register-keeping body, particulars on beneficial owners,
56. fail to fulfil the notification obligation, or fail to do so correctly, completely or in good time, contrary to section 20(2),
57. notify particulars on beneficial owners to the register-keeping body electronically for entry in the Transparency Register without being authorised to do so by the association subject to the notification obligation,
58. fail to fulfil the notification obligation, or fail to do so correctly, completely or in good time, contrary to section 20(3),
59. fail to fulfil the notification obligation, or fail to do so correctly, completely or in good time, contrary to section 20(3a), first to third sentences or subsection (3b), first sentence,
60. fail to comply with the documentation obligation, contrary to section 20(3a), fourth sentence or subsection (3b), third sentence,
61. fail, contrary to section 21(1) or (2), to
a) obtain,
b) retain, or retain correctly or completely,
c) keep up to date, or
d) notify correctly, completely or in good time to the register-keeping body, particulars on beneficial owners,
62. fail to fulfil the notification obligation, or fail to do so correctly, completely or in good time, contrary to section 21(1b),
63. fail to correct an inaccurate notification under section 20(1) or section 21(1),
64. procure inspection of the Transparency Register, contrary to section 23(1), first sentence, no. 2, by falsely representing facts, or otherwise unlawfully obtain access to the Transparency Register,
65. fail to fulfil the notification obligation, contrary to section 23a(1), first sentence,
66. as an obliged entity, fail to provide, or fail to provide in good time, information or documents, contrary to section 23a(3),
67. fail to comply, or fail to comply correctly, completely or in good time, with a request for information, contrary to section 30(3),
68. fail to comply, or fail to comply in good time or completely, with an order or an instruction, contrary to section 40(1), first or second sentence,
69. fail to file a report, or fail to file it correctly, completely or in good time, contrary to section 43(1),
70. fail to file the report without delay thereafter, contrary to section 46(2), second sentence,
71. fail to observe a prohibition under section 51(5),
72. fail to provide information, or fail to provide it correctly, completely or in good time, contrary to section 51(7),
73. contrary to section 52(1) and (6),
a) fail to provide, or fail to provide correctly, completely or in good time, information, or
b) fail to produce, or fail to produce correctly, completely or in good time, documents, 73a. fail to transmit, or fail to transmit correctly, completely or in good time, information, contrary to section 52(7), first and second sentences, or under a statutory instrument under the third and fourth sentences, or
74. fail to tolerate an examination, contrary to section 52(3). The regulatory offence may, where committed intentionally, be punished with a fine of up to EUR 150,000, and otherwise with a fine of up to EUR 100,000.
(2) It is a regulatory offence for a person intentionally or negligently to
1. fail to designate a member of the management level, contrary to section 4(3), first sentence,
2. fail to appoint an anti-money laundering officer or a deputy, contrary to section 7(1),
3. fail to comply, or fail to comply in good time, with an enforceable order under section 7(3),
4. fail to appoint a group anti-money laundering officer, contrary to section 9(1), second sentence, including in conjunction with subsection (4),
5. establish or continue the business relationship, or fail to terminate it, or fail to bring it to an end in some other way, or carry out the transaction, contrary to section 15(9), in conjunction with section 15(3), no. 2,
6. carry out a transaction, contrary to section 46(1), first sentence,
7. inform the contracting party, the party instructing the transaction, or a third party, contrary to section 47(1), in conjunction with subsection (2), or
8. fail to comply, or fail to comply in good time, with an enforceable order under section 51(2a), second sentence. The regulatory offence may, where committed intentionally, be punished with a fine of up to EUR 150,000, where committed recklessly, with a fine of up to EUR 100,000, and otherwise with a fine of up to EUR 50,000.
(2a) It is a regulatory offence for a person to infringe Regulation (EU) 2023/1113, as amended on 31 May 2023, by intentionally or negligently
1. failing to ensure, contrary to Article 14(1), (2) or (3), that a particular referred to therein is transmitted,
2. failing, contrary to Article 17(1), first subparagraph, Article 20 or Article 21(1), first subparagraph, to establish a procedure referred to therein, or failing to do so before carrying out a crypto-asset transfer,
3. failing, contrary to Article 17(1), second subparagraph or Article 21(1), second subparagraph, to reject a transfer, or to do so in good time, failing to transfer back a crypto-asset, or to do so in good time, and failing to request a particular referred to therein, or to do so in good time,
4. failing, contrary to Article 19, to ensure that a transmission referred to therein takes place, or that a particular referred to therein is made available, or
5. failing, contrary to Article 26(1), second sentence, to retain a record referred to therein, or to retain it for at least five years after the crypto-asset transfer was carried out. The regulatory offence may be punished with a fine of up to EUR 200,000.
(3) The regulatory offence under subsection (1), and, where committed intentionally or recklessly, under subsection (2) or (2a), may be punished with
1. a fine of up to EUR 1,000,000, or
2. a fine of up to twice the economic advantage derived from the infringement, where the matter involves a serious, repeated or systematic infringement. The economic advantage comprises realised profits and avoided losses, and may be estimated. Against obliged entities under section 2(1), nos. 1 to 3 and 6 to 9 that are legal persons or associations of persons, a higher fine than under the first sentence may be imposed. In such cases the fine may not exceed the higher of the following amounts:
1. EUR 5,000,000, or
2. 10 per cent of the total turnover which the legal person or association of persons achieved in the business year preceding the authority's decision. Against obliged entities under section 2(1), nos. 1 to 3 and 6 to 9 that are natural persons, a fine of up to EUR 5,000,000 may be imposed in addition to the first sentence.
(4) Total turnover within the meaning of subsection (3), fourth sentence, no. 2 is
1. for credit institutions, payment institutions, securities institutions and financial services institutions, the total amount resulting, under section 340 of the Commercial Code, from the national law applicable to the institution, consistent with Article 27, points 1, 3, 4, 6 and 7, or Article 28, Section B, points 1 to 4 and 7 of Council Directive 86/635/EEC of 8 December 1986 on the annual accounts and consolidated accounts of banks and other financial institutions (OJ L 372, 31.12.1986, p. 1), less value added tax and other taxes levied directly on those revenues,
2. for insurance undertakings, the total amount resulting from the national law applicable to the insurance undertaking, consistent with Article 63 of Council Directive 91/674/EEC of 19 December 1991 on the annual accounts and consolidated accounts of insurance undertakings (OJ L 374, 31.12.1991, p. 7), less value added tax and other taxes levied directly on those revenues,
3. in all other cases, the amount of net turnover revenue in accordance with the national law applicable to the undertaking, consistent with Article 2, point 5 of Directive 2013/34/EU. Where the legal person or association of persons is a parent undertaking or a subsidiary, the relevant total amount in the consolidated accounts of the parent undertaking prepared for the largest group of undertakings shall apply instead of the total turnover of the legal person or association of persons. Where the consolidated accounts for the largest group of undertakings are not prepared in accordance with the provisions referred to in the first sentence, total turnover shall be determined by reference to the items of the consolidated accounts comparable with those referred to in the first sentence, nos. 1 to 3. Where annual accounts or consolidated accounts for the relevant business year are not available, the annual accounts or consolidated accounts for the immediately preceding business year shall apply. Where the annual accounts or consolidated accounts for the immediately preceding business year are likewise not available, total turnover may be estimated.
(5) The supervisory authority respectively competent under section 50, nos. 1, 5a and 7a to 9 is also the administrative authority within the meaning of section 36(1), no. 1 of the Act on Regulatory Offences. For regulatory offences under subsection (1), first sentence, nos. 54 to 66, the administrative authority within the meaning of section 36(1), no. 1 of the Act on Regulatory Offences is the Federal Office of Administration.
(5a) Insofar as, under subsection (5), first sentence, the tax authority is the administrative authority, section 387(2), section 410(1), nos. 2, 6 to 11, subsection (2), and section 412 of the Fiscal Code apply mutatis mutandis.
(6) The competent administrative authority shall, insofar as it is not also the competent supervisory authority, transmit to the competent supervisory authority, on request, all information, including personal data, insofar as that information is necessary for the performance of the tasks of the supervisory authority, in particular for maintaining the statistics under section 51(9).
(7) The supervisory authorities shall check the Federal Central Criminal Register to establish whether the person concerned has a relevant conviction.
(8) The competent supervisory authorities under section 50, nos. 1, 2 and 9 shall inform the European Banking Authority, in respect of obliged entities under section 2(1), nos. 1 to 3 and 6 to 9, of
1. the fines imposed on those obliged entities,
2. other measures taken on account of infringements of the provisions of this Act or of other Acts for the prevention of money laundering or terrorist financing, and
3. related appeal proceedings and their outcomes.