Internal safeguards

(1) Institutions, and financial holding companies and mixed financial holding companies under section 25l, must, without prejudice to the duties set out in section 25a(1) of this Act and in sections 4 to 6 of the Anti-Money Laundering Act, have adequate risk management and internal safeguards serving to prevent criminal acts that could endanger the institution's assets. For this purpose, they must create and update adequate business- and customer-related protection systems and carry out controls. This also includes the continuous development of suitable strategies and safeguards to prevent the abuse of new financial products and technologies for the purposes of money laundering and terrorist financing, or for promoting the anonymity of business relationships and transactions.
(2) Credit institutions must, without prejudice to section 10(1), point 5, of the Anti-Money Laundering Act, operate and update data processing systems by means of which they are able to detect business relationships and individual transactions in payment transactions that, on the basis of the experience publicly available and available within the credit institution regarding the methods of money laundering, terrorist financing, and the other criminal acts within the meaning of subsection (1), are particularly complex or large in relation to comparable cases, follow an unusual pattern, or take place without an obvious economic or lawful purpose. Credit institutions may process personal data insofar as this is necessary to fulfil this duty. The Federal Institute may determine criteria under which credit institutions may dispense with the use of systems under the first sentence.
(3) Every transaction that is particularly complex or large in relation to comparable cases, follows an unusual pattern, or takes place without an obvious economic or lawful purpose must be examined by institutions within the meaning of subsection (1), without prejudice to section 15 of the Anti-Money Laundering Act, with adequate measures, in order to be able to monitor and assess the risk of the transaction with regard to criminal acts within the meaning of subsection (1), first sentence, and, where appropriate, examine whether to file a criminal complaint under section 158 of the Code of Criminal Procedure. The institutions must adequately document these transactions, the examinations carried out, and their results, in accordance with section 8 of the Anti-Money Laundering Act, in order to be able to demonstrate to the Federal Institute that these circumstances do not suggest that a criminal act within the meaning of subsection (1), first sentence, has been, or is being, committed or attempted. Subsection (2), second sentence, applies correspondingly. Section 47(5) of the Anti-Money Laundering Act applies correspondingly to institutions for information about concrete circumstances containing conspicuous features or irregularities suggesting criminal acts other than money laundering, a predicate offence to it, or terrorist financing.
(4) Institutions may, after prior notification to the Federal Institute, have internal safeguards under subsection (1), first sentence, carried out by a third party under contractual arrangements. The Federal Institute may require the transfer back to the institution where the third party does not offer sufficient assurance that the safeguards are properly carried out, or where the institutions' ability to manage them or the Federal Institute's ability to control them could be impaired. Responsibility for the safeguards remains with the institutions.
(5) The Federal Institute may, in the individual case, issue orders to an institution, or to an outsourcing undertaking to which an institution or a parent undertaking has outsourced under subsection (4) or under section 6(7) of the Anti-Money Laundering Act, that are suitable and necessary to take the precautions named in subsections (1) to (3).
(6) The Deutsche Bundesbank is deemed an institution within the meaning of subsections (1) to (4).
(7) The function of the anti-money-laundering officer within the meaning of section 7 of the Anti-Money Laundering Act, and the duties to prevent criminal acts within the meaning of subsection (1), first sentence, are performed within the institution by a single unit. The Federal Institute may, on the institution's application, permit a different unit within the institution to be responsible for preventing the criminal acts, insofar as good cause exists for this.