KYC in Germany: BaFin, the GwG, and the New Rules of Remote Identification (2026)

The Legal Frame: GwG and BaFin

The Geldwäschegesetz (GwG), Germany's AML statute, requires obliged entities, banks, payment firms, crypto custodians, and a long list of non-financial businesses, to identify customers and verify identity using documents, data, or information from reliable, independent sources before establishing relations. BaFin supervises financial-sector compliance and has shaped, through circulars and administrative practice, exactly which remote identification methods count.

The Four Accepted Identification Rails

Video identification. BaFin's video-ident regime allows trained agents to verify a customer in a live video session against security features of the ID document. It remains widely used, but its assumptions are under the most pressure: deepfakes and injection attacks target exactly this channel, which is why current evaluations demand synthetic-media defenses.

eID (the online function of the German identity card). Chip-based, cryptographic, and the gold standard of assurance. Adoption has historically lagged, but the German EUDI Wallet program, building toward 80 million potential users at high assurance, is set to make chip-grade identification mainstream.

Qualified electronic signature flows. Identification bundled with a QES, common in lending and account opening.

Automated document and biometric verification. Accepted in defined contexts and across much of the EU under AMLR-era technical standards, and the rail where the market is heading: machine-led document forensics, liveness, and face match, with consistency that human video agents cannot match at scale.

What AMLA's Frankfurt Era Changes

With AMLA operational in Frankfurt and the EU's single AML rulebook (AMLR) replacing fragmented national interpretation over the transition period, German practice is converging with European technical standards: stronger expectations on remote-identification security, continuous rather than point-in-time due diligence, and harmonized evidence requirements. For compliance teams the message is simple: the examiner of the future asks for machine-verifiable evidence. Verifications signed and anchored at proof.deepidv.com, with screening run continuously by Arbiter, are designed for precisely that examination style, and published per-check pricing keeps the economics modelable in a market where video-ident sessions have historically cost multiples of automated checks.