Internal safeguards

(1) Securities institutions, securities institution groups, investment holding companies, mixed financial holding companies, and parent undertakings of securities institution groups must, without prejudice to the duties listed in sections 4 to 6 of the Anti-Money Laundering Act and the organisational duties contained in this Act, have adequate risk management and internal safeguards serving to prevent criminal acts that could endanger the assets of the securities institution. They must establish and keep up to date adequate business- and customer-related safeguard systems for this purpose, and carry out controls. This also includes the ongoing development of suitable strategies and safeguards to prevent the misuse of new financial products and technologies for the purposes of money laundering and terrorist financing, or the facilitation of anonymity in business relationships and transactions.
(2) Every transaction that, compared with similar cases, is particularly complex or large, follows an unusual pattern, or has no apparent economic or lawful purpose, must be investigated by securities institutions and by investment holding companies or mixed financial holding companies, without prejudice to section 15 of the Anti-Money Laundering Act, with appropriate measures, so as to be able to monitor and assess the risk of the transaction with regard to criminal acts within the meaning of subsection (1), first sentence, and, where appropriate, to consider filing a criminal complaint under section 158 of the Code of Criminal Procedure. Securities institutions and investment holding companies or mixed financial holding companies must adequately document these transactions, the investigations carried out and their results, in accordance with section 8 of the Anti-Money Laundering Act, so as to be able to demonstrate to the Bundesanstalt that these circumstances do not suggest that a criminal act within the meaning of subsection (1), first sentence has been, or is being, committed or attempted. Securities institutions and investment holding companies or mixed financial holding companies may process personal data insofar as necessary to perform these duties. Section 47(5) of the Anti-Money Laundering Act applies correspondingly to securities institutions in respect of information on specific circumstances containing anomalies or unusual features indicating criminal acts other than money laundering, a predicate offence of money laundering, or terrorist financing.
(3) Securities institutions and investment holding companies or mixed financial holding companies may, after prior notification to the Bundesanstalt, have internal safeguards under subsection (1), first sentence carried out by a third party under contractual arrangements. The Bundesanstalt may require the transfer back to the securities institution, and to the investment holding companies or mixed financial holding companies, where the third party does not offer assurance that the safeguards are properly carried out, or where the control options of the securities institution and the investment holding companies or mixed financial holding companies, and the monitoring options of the Bundesanstalt, could be impaired. Responsibility for the safeguards remains with the securities institutions and the investment holding companies or mixed financial holding companies.
(4) The Bundesanstalt may, in an individual case, issue orders to a securities institution, an investment holding company, a mixed financial holding company, or an outsourcing undertaking to which a securities institution or a parent undertaking has outsourced under subsection (3) or under section 6(7) of the Anti-Money Laundering Act, that are suitable and necessary to give effect to the arrangements referred to in subsections (1) and (2).
(5) The function of anti-money laundering officer within the meaning of section 7 of the Anti-Money Laundering Act, and the duties to prevent criminal acts under subsection (1), first sentence, are performed by a single office within the securities institution and within the investment holding company or mixed financial holding company. The Bundesanstalt may, on application of the securities institution and the investment holding companies or mixed financial holding companies, permit another office within the securities institution, the investment holding company or the mixed financial holding company to be responsible for preventing criminal acts, provided important cause exists for this.